Apache – CVE-2016-8743

Home » Blog » Apache – CVE-2016-8743

Description

Kayran has detected that the version of Apache HTTP Server being used is accepting whitespace characters from requests that are sent in response lines and headers.
Accepting these different behaviors represent a security concern when httpd participates in any chain of proxies or interacts with back-end application servers. Also known as CVE-2016-8743.

Through mod_proxy or using conventional CGI mechanisms, remote attackers could possibly abuse this flaw to inject data into HTTP responses, which results in proxy cache poisoning.
It could also lead to request smuggling and response splitting.

Severity/Score

CVSS Version 3.x – 7.5 High

Recommendation

To fix CVE-2016-8743, upgrade the version of Apache Server being used to either 2.2.32 or 2.4.25.

References

https://cwe.mitre.org/data/definitions/20.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8743

< Return to all Vulnerabilities

Incident Response

Quickly! – Incident Response – IR

In the field of information security, one of the most important factors is speed. Quickly! Is the way we must respond to each case individually.

Tracing your Requests

Like mentioned here, There are several HTTP request methods, each with its own purpose and uses, In this article we’ll talk about the TRACE Method.

Understanding Attackers

Understanding Attackers

Looking in the Attacker’s eyes – There are many ways we can do it. So when we want to achieve the goal of Understanding Attackers,

Red Team

You’ve probably heard that there are teams in the Cyber field called Red Team and Blue Team. Let’s talk about the red one, shall we?

Lights, camera, where is the Script? – JavaScript in short

We know HTML is all about editing, CSS is all about designing, what’s left you ask? Well, JavaScript of course! In other words, JS is

Spywares – 007’ing Your Devices

We’ve talked about Malwares before. Let’s talk about one of the most dangerous types of malwares: Spywares. One of my favorite movie series is James

WEB APPLICATION VULNERABILITY SCANNER

Links

registered user?