Apache2 - Regression Update (DLA-841-2)
Summary
DLA-841-2: apache2 - regression update. Affects apache2 versions < 2.2.22-13+deb7u11. Fixed in 2.2.22-13+deb7u11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software. It provides a robust and scalable platform for hosting websites and applications. The vulnerability addressed in this update affects Apache2's header parsing code, which is responsible for processing HTTP requests. The vulnerability was discovered by David Dennerline and Régi Leroy of IBM Security's X-Force Researchers. It involves the mishandling of unusual whitespace patterns in HTTP requests, which can lead to response splitting or cache pollution vulnerabilities. This update makes Apache2 more strict in accepting HTTP requests to mitigate these issues.
Vulnerability Detail
The vulnerability in Apache2's header parsing code allows for potential response splitting or cache pollution attacks. By exploiting unusual whitespace patterns in HTTP requests, an attacker can manipulate the server's response or pollute the cache, potentially leading to various security risks. This update addresses the vulnerability by enforcing stricter checks on HTTP requests to prevent such attacks.
How To Fix
Minimum fixed version
2.2.22-13+deb7u11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version causes issues with non-conforming clients, a workaround is available. By adding the directive 'HttpProtocolOptions unsafe' to the Apache configuration, some checks can be relaxed. However, it is important to note that this workaround may introduce potential security risks, so it should be used with caution.
Conclusion
This update addresses a vulnerability in Apache2's header parsing code that could lead to response splitting or cache pollution attacks. It is recommended to upgrade to the fixed version or apply the provided workaround, depending on your specific requirements. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
The vulnerability can potentially lead to response splitting or cache pollution attacks, which can have various security implications such as data manipulation, session hijacking, or information disclosure.
The vulnerability was discovered by David Dennerline and Régi Leroy of IBM Security's X-Force Researchers.
The fix enforces stricter checks on HTTP requests, specifically addressing the mishandling of unusual whitespace patterns that could be exploited for response splitting or cache pollution attacks.
At the time of this update, there are no known public exploits targeting this vulnerability. However, it is always recommended to apply security updates promptly to mitigate potential risks.
Yes, the workaround of relaxing some checks in the Apache configuration may introduce potential security risks. It should be used cautiously and only if necessary.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
