Apache2 - Header Parsing Code Security Vulnerability
Summary
DLA-841-1: apache2 - security update. Affects apache2 versions < 2.2.22-13+deb7u8. Fixed in 2.2.22-13+deb7u8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache2 is a widely used open-source web server software that provides a secure, efficient, and extensible server platform. It is capable of serving both static and dynamic content and is highly configurable. The vulnerability in the header parsing code of Apache2 allows for response splitting or cache pollution attacks, which can lead to various security risks.
Vulnerability Detail
The vulnerability in Apache2's header parsing code was discovered by David Dennerline and Régi Leroy. It arises from the way Apache handles unusual whitespace patterns in HTTP requests. In certain configurations, this vulnerability can be exploited to perform response splitting or cache pollution attacks. To address this issue, Apache httpd has been made more strict in accepting HTTP requests.
How To Fix
Minimum fixed version
2.2.22-13+deb7u8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version causes issues with non-conforming clients, you can relax some checks by adding the new directive 'HttpProtocolOptions unsafe' to the Apache configuration. However, this workaround should be used with caution as it may introduce security risks.
Conclusion
In conclusion, the header parsing code vulnerability in Apache2 can be mitigated by upgrading to the latest version of the apache2 package. If any issues arise, the 'HttpProtocolOptions unsafe' directive can be used as a workaround, although caution should be exercised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache2 is an open-source web server software that provides a secure and efficient platform for serving web content.
This vulnerability can lead to response splitting or cache pollution attacks, which can have various security implications such as data manipulation or injection.
To fix this vulnerability, you should upgrade the apache2 package to the latest version available for your system.
If upgrading to the fixed version causes issues, you can add the 'HttpProtocolOptions unsafe' directive to the Apache configuration as a workaround. However, this may introduce security risks.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
