Vulnerabilities

TI-2016-07200 CVE-2016-8743 · GHSA-2rfh-2gh8-v9fq

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the…

MEDIUM 47

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13252 Published 2017-07-27 Partial fix

TI-2016-01972 CVE-2016-2161 · GHSA-3v6f-955w-932h

Improper input validation in Apache HTTP Server

MEDIUM 52

In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.20952 Published 2017-07-27 Fixed CWE-823

TI-2016-00660 CVE-2016-0736 · GHSA-mxm5-vg5c-rx7v

Cryptographic flaw in Apache HTTP Server

MEDIUM 64

In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectab…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.49024 Published 2017-07-27 Partial fix CWE-310

Vulnerabilities

Filters

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the…

Improper input validation in Apache HTTP Server

Cryptographic flaw in Apache HTTP Server