{"id":"CVE-2016-8743","aliases":["BELL-CVE-2016-8743","DEBIAN-CVE-2016-8743","DLA-841-1","DLA-841-2","DSA-3796-1","EUVD-2016-9577","GHSA-2rfh-2gh8-v9fq","MGASA-2018-0007","RHSA-2017:0906","RHSA-2017:1161","RHSA-2017:1413","RHSA-2017:1414","RHSA-2017:1721","SUSE-SU-2017:0729-1","SUSE-SU-2017:0797-1","SUSE-SU-2017:0801-1","SUSE-SU-2018:2554-1","SUSE-SU-2018:2815-1","SUSE-SU-2018:2815-2","UBUNTU-CVE-2016-8743","USN-3279-1"],"status":"published","title":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace...","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.13252,"percentile":0.96409,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2016-12-22T00:00:00Z","modified":"2026-10-24T10:30:26Z","fixes":[{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.25-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.25-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.25-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"apache2","fixed_in":["2.2.22-13+deb7u8","2.2.22-13+deb7u11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd-debuginfo","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd-tools","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd-devel","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd-manual","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_ssl","fixed_in":["1:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd-debuginfo","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd-tools","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd-devel","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd-manual","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_ssl","fixed_in":["1:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd-debuginfo","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd-devel","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd-manual","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd-tools","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_ssl","fixed_in":["1:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd-debuginfo","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd-devel","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd-manual","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd-tools","fixed_in":["0:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_ssl","fixed_in":["1:2.2.15-60.el6_9.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"apache2","fixed_in":["2.4.7-1ubuntu4.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"apache2","fixed_in":["2.4.18-2ubuntu3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-13+deb7u8"}]}],"versions":["2.2.22-13","2.2.22-13+deb7u1","2.2.22-13+deb7u2","2.2.22-13+deb7u3","2.2.22-13+deb7u4","2.2.22-13+deb7u5","2.2.22-13+deb7u6","2.2.22-13+deb7u7"]},{"source":"osv","ecosystem":"Debian:7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-13+deb7u11"}]}],"versions":["2.2.22-13","2.2.22-13+deb7u1","2.2.22-13+deb7u10","2.2.22-13+deb7u2","2.2.22-13+deb7u3","2.2.22-13+deb7u4","2.2.22-13+deb7u5","2.2.22-13+deb7u6","2.2.22-13+deb7u7","2.2.22-13+deb7u8","2.2.22-13+deb7u9"]},{"source":"osv","ecosystem":"Debian:8","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-10+deb8u8"}]}],"versions":["2.4.10-10","2.4.10-10+deb8u1","2.4.10-10+deb8u2","2.4.10-10+deb8u3","2.4.10-10+deb8u4","2.4.10-10+deb8u5","2.4.10-10+deb8u6","2.4.10-10+deb8u7"],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-16.7.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-45.el7_3.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-19.GA.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-19.GA.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.23-120.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-19.GA.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_security-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-19.GA.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.23-120.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el6","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.15-60.el6_9.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.12-69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-20.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-20.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu4.15"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4","2.4.7-1ubuntu4.1","2.4.7-1ubuntu4.4","2.4.7-1ubuntu4.5","2.4.7-1ubuntu4.6","2.4.7-1ubuntu4.7","2.4.7-1ubuntu4.8","2.4.7-1ubuntu4.9","2.4.7-1ubuntu4.10","2.4.7-1ubuntu4.11","2.4.7-1ubuntu4.13"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-2ubuntu3.2"}]}],"versions":["2.4.12-2ubuntu2","2.4.17-1ubuntu1","2.4.17-2ubuntu1","2.4.17-3ubuntu1","2.4.18-1ubuntu1","2.4.18-2ubuntu1","2.4.18-2ubuntu2","2.4.18-2ubuntu3","2.4.18-2ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu4.15"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4","2.4.7-1ubuntu4.1","2.4.7-1ubuntu4.4","2.4.7-1ubuntu4.5","2.4.7-1ubuntu4.6","2.4.7-1ubuntu4.7","2.4.7-1ubuntu4.8","2.4.7-1ubuntu4.9","2.4.7-1ubuntu4.10","2.4.7-1ubuntu4.11","2.4.7-1ubuntu4.13"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-2ubuntu3.2"}]}],"versions":["2.4.12-2ubuntu2","2.4.17-1ubuntu1","2.4.17-2ubuntu1","2.4.17-3ubuntu1","2.4.18-1ubuntu1","2.4.18-2ubuntu1","2.4.18-2ubuntu2","2.4.18-2ubuntu3","2.4.18-2ubuntu3.1"],"bundled":3}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"oncommand_unified_manager"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"redhat","product":"jboss_core_services"}],"references":[{"url":"https://support.apple.com/HT208221","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2017/dsa-3796","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1721","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1037508","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1413","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1161","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2017-04","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1414","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03753en_us","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/95077","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03725en_us","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-1415.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0906","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-8743","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-36","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20180423-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r94284b139540e5287ebdd3450682d3e3d187263dd6b75af8fa7d4890%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4fe84db67fe9dc906c6185e58bbd9913f4356dd555a5c3db490694e5%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r09b8a39d1262adbab5528eea73df1b1f93e919bf004ed5a843d9cad1%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfcb6c7b9e7ca727a7eeeb5f13f89488a03981cfa0e7c3125f18fa239%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8743","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r09b8a39d1262adbab5528eea73df1b1f93e919bf004ed5a843d9cad1@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r4fe84db67fe9dc906c6185e58bbd9913f4356dd555a5c3db490694e5@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r94284b139540e5287ebdd3450682d3e3d187263dd6b75af8fa7d4890@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rfcb6c7b9e7ca727a7eeeb5f13f89488a03981cfa0e7c3125f18fa239@%3Ccvs.httpd.apache.org%3E"},{"url":"https://security.netapp.com/advisory/ntap-20180423-0001"},{"url":"https://github.com/advisories/GHSA-2rfh-2gh8-v9fq"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-8743","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-8743","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0007.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20002","tags":["report"]},{"url":"https://www.debian.org/security/2017/dsa-3896","tags":["web"]},{"url":"https://www.debian.org/security/2017/dsa-3913","tags":["web"]},{"url":"https://usn.ubuntu.com/usn/usn-3425-1/","tags":["web"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["web","article","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1420002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1420047","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1429947","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0906.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0736","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25","tags":["article"]},{"url":"https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2161","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375968","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4975","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975","tags":["article"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8743","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8743","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-httpd","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1329639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1336350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1401528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1414037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1433474","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1161.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1546","tags":["advisory"]},{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8740","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Dec/3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1866559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11985","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11985","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11985","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en/red-hat-jboss-core-services/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377600","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1384743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1412120","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBCS-319","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1413.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6304","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20160922.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7056","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","tags":["advisory"]},{"url":"http://security.360.cn/cve/CVE-2016-8610","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBCS-318","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1414.json","tags":["advisory"]},{"url":"https://access.redhat.com/articles/3013361","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463354","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1721.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1016714","tags":["report"]},{"url":"https://bugzilla.suse.com/1016715","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8743","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170797-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1016712","tags":["report"]},{"url":"https://bugzilla.suse.com/1019380","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0736","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170801-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/980663","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182554-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1104826","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4975","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182815-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182815-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-8743","tags":["report"]},{"url":"https://lists.apache.org/thread.html/139862b41c0dfd5e6e00ad89c00119f9faf0dd41a2f927da9c9a4076@%3Cannounce.httpd.apache.org%3E","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3279-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3373-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-0736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2161","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-8743","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","status":"published","published":"2017-07-27T21:00:00Z","modified":"2024-09-16T17:03:31.158Z","updated_at":"2026-11-02T14:33:32.724067Z"}],"euvd":[{"id":"EUVD-2016-9577","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","status":"published","published":"2017-07-27T21:00:00Z","modified":"2024-09-16T17:03:31Z","updated_at":"2026-11-03T00:55:45.787721Z"}],"ghsa":[{"id":"GHSA-2rfh-2gh8-v9fq","title":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace...","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","status":"published","published":"2022-05-13T01:09:42Z","modified":"2025-04-20T03:42:38Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:01:50.044707Z"}],"nvd":[{"id":"CVE-2016-8743","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","status":"published","published":"2017-07-27T21:29:00.287Z","modified":"2026-06-17T00:54:55.81Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"BELL-CVE-2016-8743","title":"CVE-2016-8743 does not affect BellSoft software","status":"withdrawn","published":"2017-07-27T21:29:00Z","modified":"2026-01-26T09:48:19.382847Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-8743","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","status":"published","published":"2017-07-27T21:29:00.287Z","modified":"2026-10-24T10:30:26.29732856Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-8743","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","status":"published","published":"2017-07-27T21:29:00.287Z","modified":"2026-09-22T07:02:27.55073102Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"RHSA-2017:0906","title":"Red Hat Security Advisory: httpd security and bug fix update","status":"published","published":"2024-09-13T14:39:19Z","modified":"2026-09-21T10:01:38Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:1161","title":"Red Hat Security Advisory: httpd24-httpd security, bug fix, and enhancement update","status":"published","published":"2024-09-13T21:58:36Z","modified":"2026-09-21T10:01:39Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:1413","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7","status":"published","published":"2024-09-13T14:40:13Z","modified":"2026-09-21T10:01:40Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:1414","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 6","status":"published","published":"2024-09-13T14:40:20Z","modified":"2026-09-21T10:01:41Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:1721","title":"Red Hat Security Advisory: httpd security and bug fix update","status":"published","published":"2024-09-13T14:40:43Z","modified":"2026-09-21T10:01:42Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-8743","description":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","status":"published","published":"2016-12-22T00:00:00Z","modified":"2026-04-22T11:02:08.624841Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-841-1","title":"apache2 - security update","status":"published","published":"2017-02-28T00:00:00Z","modified":"2026-03-09T02:10:20.622804Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DLA-841-2","title":"apache2 - regression update","status":"published","published":"2017-07-29T00:00:00Z","modified":"2026-03-09T02:09:29.606064Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3796-1","title":"apache2 - security update","status":"published","published":"2017-02-26T00:00:00Z","modified":"2026-03-09T02:09:28.44561Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0007","title":"Updated apache packages fix security vulnerability","description":"mod_sessioncrypto was encrypting its data/cookie using the configured ciphers\nwith possibly either CBC or ECB modes of operation (AES256-CBC by default),\nhence no selectable or builtin authenticated encryption. This made it\nvulnerable to padding oracle attacks, particularly with CBC (CVE-2016-0736).\n\nMalicious input to mod_auth_digest will cause the server to crash, and each\ninstance continues to crash even for subsequently valid requests\n(CVE-2016-2161).\n\nEmmanuel Dreyfus reported that the use of ap_get_basic_auth_pw() by third-party\nmodules outside of the authentication phase may lead to authentication\nrequirements being bypassed (CVE-2017-3167).\n\nVasileios Panopoulos of AdNovum Informatik AG discovered that mod_ssl may\ndereference a NULL pointer when third-party modules call\nap_hook_process_connection() during an HTTP request to an HTTPS port leading to\na denial of service (CVE-2017-3169).\n\nJavier Jimenez reported that the HTTP strict parsing contains a flaw leading to\na buffer overread in ap_find_token(). A remote attacker can take advantage of\nthis flaw by carefully crafting a sequence of request headers to cause a\nsegmentation fault, or to force ap_find_token() to return an incorrect value\n(CVE-2017-7668).\n\nChenQin and Hanno Boeck reported that mod_mime can read one byte past the end of\na buffer when sending a malicious Content-Type response header (CVE-2017-7679).\n\nRobert Swiecki reported that mod_auth_digest does not properly initialize or\nreset the value placeholder in [Proxy-]Authorization headers of type \"Digest\"\nbetween successive key=value assignments, leading to information disclosure or\ndenial of service (CVE-2017-9788).\n\nHanno Böck discovered that the Apache HTTP Server incorrectly handled Limit\ndirectives in .htaccess files. In certain configurations, a remote attacker\ncould possibly use this issue to read arbitrary server memory, including\nsensitive information. This issue is known as Optionsbleed (CVE-2017-9798).\n","status":"published","published":"2018-01-01T10:38:51Z","modified":"2026-04-16T06:26:01.391943099Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:0729-1","title":"Security update for apache2","description":"\nThis update for apache2 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-2161: Malicious input to mod_auth_digest could have caused the server to crash,\n  resulting in DoS (bsc#1016714).\n- CVE-2016-8743: Added new directive 'HttpProtocolOptions Strict' to avoid proxy chain\n  misinterpretation (bsc#1016715).\n","status":"published","published":"2017-03-17T13:58:38Z","modified":"2026-02-04T02:16:29.67912Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0797-1","title":"Security update for apache2","description":"\nThis update for apache2 fixes the following security issues:\n\nSecurity issues fixed:\n- CVE-2016-0736: Protect mod_session_crypto data with a MAC to prevent padding oracle attacks (bsc#1016712).\n- CVE-2016-2161: Malicious input to mod_auth_digest could have caused the server to crash, resulting in DoS (bsc#1016714).\n- CVE-2016-8743: Added new directive 'HttpProtocolOptions Strict' to avoid proxy chain misinterpretation (bsc#1016715).\n\nBugfixes:\n- Add missing copy of hcuri and hcexpr from the worker to the health check worker (bsc#1019380).\n","status":"published","published":"2017-03-22T14:54:19Z","modified":"2026-02-04T02:22:39.069212Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0801-1","title":"Security update for apache2","description":"\nThis update for apache2 provides the following fixes:\n\nSecurity issues fixed:\n- CVE-2016-0736: Protect mod_session_crypto data with a MAC to prevent padding oracle attacks (bsc#1016712).\n- CVE-2016-2161: Malicious input to mod_auth_digest could have caused the server to crash, resulting in DoS (bsc#1016714).\n- CVE-2016-8743: Added new directive 'HttpProtocolOptions Strict' to avoid proxy chain misinterpretation (bsc#1016715).\n\nBugfixes:\n- Add NotifyAccess=all to systemd service files to prevent warnings in the log when using mod_systemd (bsc#980663).\n","status":"published","published":"2017-03-22T14:52:52Z","modified":"2026-02-04T03:21:53.007561Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2018:2554-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests\n  and sent in response lines and headers. Accepting these different behaviors\n  represented a security concern when httpd participates in any chain of\n  proxies or interacts with back-end application servers, either through\n  mod_proxy or using conventional CGI mechanisms, and may result in request\n  smuggling, response splitting and cache pollution. (bsc#1016715)\n- CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting\n  attacks for sites which use mod_userdir. This issue was mitigated by changes\n  which prohibit CR or LF injection into the 'Location' or other outbound\n  header key or value. (bsc#1104826)\n  ","status":"published","published":"2018-08-30T06:44:40Z","modified":"2025-05-02T04:05:19.847069Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2815-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests\n  and sent in response lines and headers. Accepting these different behaviors\n  represented a security concern when httpd participates in any chain of\n  proxies or interacts with back-end application servers, either through\n  mod_proxy or using conventional CGI mechanisms, and may result in request\n  smuggling, response splitting and cache pollution. (bsc#1016715)\n- CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting\n  attacks for sites which use mod_userdir. This issue was mitigated by changes\n  which prohibit CR or LF injection into the 'Location' or other outbound\n  header key or value. (bsc#1104826)\n  ","status":"published","published":"2018-09-24T06:07:56Z","modified":"2026-02-04T03:25:58.701964Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2815-2","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests\n  and sent in response lines and headers. Accepting these different behaviors\n  represented a security concern when httpd participates in any chain of\n  proxies or interacts with back-end application servers, either through\n  mod_proxy or using conventional CGI mechanisms, and may result in request\n  smuggling, response splitting and cache pollution. (bsc#1016715)\n- CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting\n  attacks for sites which use mod_userdir. This issue was mitigated by changes\n  which prohibit CR or LF injection into the 'Location' or other outbound\n  header key or value. (bsc#1104826)\n  ","status":"published","published":"2018-10-18T12:50:21Z","modified":"2026-02-04T02:13:17.779315Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3279-1","title":"apache2 vulnerabilities","description":"It was discovered that the Apache mod_session_crypto module was encrypting\ndata and cookies using either CBC or ECB modes. A remote attacker could\npossibly use this issue to perform padding oracle attacks. (CVE-2016-0736)\n\nMaksim Malyutin discovered that the Apache mod_auth_digest module\nincorrectly handled malicious input. A remote attacker could possibly use\nthis issue to cause Apache to crash, resulting in a denial of service.\n(CVE-2016-2161)\n\nDavid Dennerline and Régis Leroy discovered that the Apache HTTP Server\nincorrectly handled unusual whitespace when parsing requests, contrary to\nspecifications. When being used in combination with a proxy or backend\nserver, a remote attacker could possibly use this issue to perform an\ninjection attack and pollute cache. This update may introduce compatibility\nissues with clients that do not strictly follow HTTP protocol\nspecifications. A new configuration option \"HttpProtocolOptions Unsafe\" can\nbe used to revert to the previous unsafe behaviour in problematic\nenvironments. (CVE-2016-8743)\n","status":"published","published":"2017-05-09T14:16:57Z","modified":"2026-04-22T09:35:24.644366Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}