The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does…
Priority HIGH 68Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 32 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
Why it matters now
EPSS 0.55724 99th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 32 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 45
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.2.0 – 2.2.31; 2.4.1 – 2.4.23 | Vulnerable | Apache |
| cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:* | up to 7.5.5.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:oracle:communications_user_data_repository:*:*:*:*:*:*:*:* | 10.0.0 – 12.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* | 12.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:* | 12.3.2 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:* | 5 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* | 6 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:* | 7 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:* | 11.3 | Vulnerable | Oracle |
| cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* | 23 | Vulnerable | Fedoraproject |
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.2.0 – 2.2.31; 2.4.1 – 2.4.23 Vulnerable ·Apache
- cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:* Versions up to 7.5.5.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:oracle:communications_user_data_repository:*:*:*:*:*:*:*:* Versions 10.0.0 – 12.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* Versions 12.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:* Versions 12.3.2 Vulnerable ·Oracle
- cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:* Versions 5 Vulnerable ·Oracle
- cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* Versions 6 Vulnerable ·Oracle
- cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:* Versions 7 Vulnerable ·Oracle
- cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:* Versions 11.3 Vulnerable ·Oracle
- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Fedoraproject
Show 35 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:* | 24 | Vulnerable | Fedoraproject |
| cpe:2.3:a:redhat:jboss_web_server:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* | 7.5 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:* | 15.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* | 42.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* | 13.2 | Vulnerable | openSUSE |
- cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·Fedoraproject
- cpe:2.3:a:redhat:jboss_web_server:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:* Versions 15.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* Versions 42.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE
Remediation
Red Hat 11 advisories
- RHSA-2016:1851 Released 2016-09-12 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP 2.4.6 Service Pack 1 security update
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd-2.4.6-77.SP1.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.6-77.SP1.jbcs.el6, jbcs-httpd24-httpd-manual-2.4.6-77.SP1.jbcs.el6 +7
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.6-77.SP1.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.6-77.SP1.jbcs.el7, jbcs-httpd24-httpd-manual-2.4.6-77.SP1.jbcs.el7 +7
- RHSA-2016:1648 Released 2016-08-22 · Red Hat rating ImportantRed Hat JBoss Web Server 2.1.1 security update on RHEL 7
- Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server httpd22-2.2.26-56.ep6.el7, httpd22-devel-2.2.26-56.ep6.el7, httpd22-manual-2.2.26-56.ep6.el7 +17
- RHSA-2016:1649 Released 2016-08-22 · Red Hat rating ImportantRed Hat JBoss Web Server 2.1.1 security update on RHEL 6
- Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server httpd-2.2.26-54.ep6.el6, httpd-2.2.26-54.ep6.el6.i386, httpd-devel-2.2.26-54.ep6.el6 +26
Show 8 more Red Hat advisories
- RHSA-2016:1650 Released 2016-08-22 · Red Hat rating ImportantRed Hat JBoss Web Server 2.1.1 security update
- Red Hat JBoss Web Server 2.1
- RHSA-2016:1636 Released 2016-08-18 · Red Hat rating ImportantRed Hat JBoss Web Server 3.0.3 Service Pack 1 security update
- Red Hat JBoss Web Server 3.0 for RHEL 6 httpd24-2.4.6-62.ep7.el6, httpd24-devel-2.4.6-62.ep7.el6, httpd24-manual-2.4.6-62.ep7.el6 +25
- RHSA-2016:1635 Released 2016-08-18 · Red Hat rating ImportantRed Hat JBoss Web Server 3.0.3 Service Pack 1 security update
- Red Hat JBoss Web Server 3.0 for RHEL 7 httpd24-2.4.6-62.ep7.el7, httpd24-devel-2.4.6-62.ep7.el7, httpd24-manual-2.4.6-62.ep7.el7 +25
- RHSA-2016:1625 Released 2016-08-17 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP 2.4.6 Service Pack 1 security update
- Red Hat JBoss Core Services
- RHSA-2016:1624 Released 2016-08-17 · Red Hat rating ImportantRed Hat JBoss Web Server 3.0.3 Service Pack 1 security update
- Red Hat JBoss Web Server 3.0
- RHSA-2016:1421 Released 2016-07-18 · Red Hat rating Importanthttpd security update
- Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-92.el5_11, httpd-2.2.3-92.el5_11.i386, httpd-2.2.3-92.el5_11.ia64 +13
- Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-92.el5_11, httpd-2.2.3-92.el5_11.i386, mod_ssl-1:2.2.3-92.el5_11 +1
- Red Hat Enterprise Linux Desktop (v. 6) httpd-2.2.15-54.el6_8, httpd-tools-2.2.15-54.el6_8
- Red Hat Enterprise Linux Desktop Optional (v. 6) httpd-devel-2.2.15-54.el6_8, httpd-manual-2.2.15-54.el6_8, mod_ssl-1:2.2.15-54.el6_8
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) httpd-2.2.3-92.el5_11, httpd-devel-2.2.3-92.el5_11, httpd-devel-2.2.3-92.el5_11.i386 +2
- Red Hat Enterprise Linux HPC Node (v. 6) httpd-2.2.15-54.el6_8, httpd-tools-2.2.15-54.el6_8
- Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd-devel-2.2.15-54.el6_8, httpd-manual-2.2.15-54.el6_8, mod_ssl-1:2.2.15-54.el6_8
- Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-54.el6_8, httpd-devel-2.2.15-54.el6_8, httpd-devel-2.2.15-54.el6_8.ppc +3
- Red Hat Enterprise Linux Workstation (v. 6) httpd-2.2.15-54.el6_8, httpd-devel-2.2.15-54.el6_8, httpd-manual-2.2.15-54.el6_8 +2
- RHSA-2016:1422 Released 2016-07-18 · Red Hat rating Importanthttpd security and bug fix update
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-40.el7_2.4, httpd-devel-2.4.6-40.el7_2.4, httpd-manual-2.4.6-40.el7_2.4 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-40.el7_2.4, httpd-devel-2.4.6-40.el7_2.4, httpd-manual-2.4.6-40.el7_2.4 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-40.el7_2.4, httpd-devel-2.4.6-40.el7_2.4, httpd-manual-2.4.6-40.el7_2.4 +2
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-40.el7_2.4, mod_proxy_html-1:2.4.6-40.el7_2.4, mod_session-2.4.6-40.el7_2.4
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-40.el7_2.4, httpd-devel-2.4.6-40.el7_2.4, httpd-manual-2.4.6-40.el7_2.4 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-40.el7_2.4, mod_proxy_html-1:2.4.6-40.el7_2.4, mod_session-2.4.6-40.el7_2.4
- RHSA-2016:1420 Released 2016-07-18 · Red Hat rating Importanthttpd24-httpd security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd-2.4.18-11.el6, httpd24-httpd-devel-2.4.18-11.el6, httpd24-httpd-manual-2.4.18-11.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd-2.4.18-11.el7, httpd24-httpd-devel-2.4.18-11.el7, httpd24-httpd-manual-2.4.18-11.el7 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) httpd24-httpd-2.4.18-11.el6, httpd24-httpd-devel-2.4.18-11.el6, httpd24-httpd-manual-2.4.18-11.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) httpd24-httpd-2.4.18-11.el6, httpd24-httpd-devel-2.4.18-11.el6, httpd24-httpd-manual-2.4.18-11.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) httpd24-httpd-2.4.18-11.el7, httpd24-httpd-devel-2.4.18-11.el7, httpd24-httpd-manual-2.4.18-11.el7 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) httpd24-httpd-2.4.18-11.el7, httpd24-httpd-devel-2.4.18-11.el7, httpd24-httpd-manual-2.4.18-11.el7 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd-2.4.18-11.el6, httpd24-httpd-devel-2.4.18-11.el6, httpd24-httpd-manual-2.4.18-11.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd-2.4.18-11.el7, httpd24-httpd-devel-2.4.18-11.el7, httpd24-httpd-manual-2.4.18-11.el7 +5
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2016:1422 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2016:1422 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2016:1422 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2016:1422 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2016:1421 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2016:1422 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2016:1422 |
| Red Hat JBoss Core Services | Fixed | RHSA-2016:1625 |
| Red Hat JBoss Core Services on RHEL 6 Server | Fixed | RHSA-2016:1851 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2016:1851 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server | Fixed | RHSA-2016:1649 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server | Fixed | RHSA-2016:1648 |
| Red Hat JBoss Web Server 2.1 | Fixed | RHSA-2016:1650 |
| Red Hat JBoss Web Server 3.0 | Fixed | RHSA-2016:1624 |
| Red Hat JBoss Web Server 3.0 for RHEL 6 | Fixed | RHSA-2016:1636 |
| Red Hat JBoss Web Server 3.0 for RHEL 7 | Fixed | RHSA-2016:1635 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2016:1420 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2016:1420 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) | Fixed | RHSA-2016:1420 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) | Fixed | RHSA-2016:1420 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) | Fixed | RHSA-2016:1420 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) | Fixed | RHSA-2016:1420 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2016:1420 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2016:1420 |
Not affected: 1 product
- Red Hat JBoss Enterprise Application Platform 7
Timeline
- 2026-10-02 Threatist record created from CVE-2016-5387
- 2026-10-03 Alias added: GHSA-9hqr-6p2v-pfp2
References
Patch 2
Advisory 29
- RHSA-2016:1420
- RHSA-2016:1635
- https://support.apple.com/HT208221
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- RHSA-2016:1851
- USN-3038-1
- VU#797896
- openSUSE-SU-2016:1824
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- RHSA-2016:1648
- https://www.tenable.com/security/tns-2017-04
- RHSA-2016:1625
- DSA-3623
- RHSA-2016:1649
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
- RHSA-2016:1422
- http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
- RHSA-2016:1421
- FEDORA-2016-a29c65b00f
- RHSA-2016:1650
- RHSA-2016:1624
- https://www.apache.org/security/asf-httpoxy-response.txt
- FEDORA-2016-df0726ae26
- https://httpoxy.org/
- GLSA-201701-36
- RHSA-2016:1636
- FEDORA-2016-9fd9bfab9e
- FEDORA-2016-683d0b257b
Other 21
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1888194 [10/13] - /httpd/site/trunk/content/security/json/
- [httpd-cvs] 20210330 svn commit: r1073139 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
Sources
- CVE-2016-5387 · CVE Program
- CVE-2016-5387 · NVD
- FIRST EPSS
- GHSA-9hqr-6p2v-pfp2 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-5387 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences