openSUSE Security Update : apache2 (openSUSE-2018-1046)
Medium Nessus Plugin ID 117789
Synopsis
The remote openSUSE host is missing a security update.
Description
This update for apache2 fixes the following issues :
Security issues fixed :
- CVE-2016-8743: Fixed liberal whitespace interpretation
accepted from requests and sent in response lines and
headers. Accepting these different behaviors represented
a security concern when httpd participates in any chain
of proxies or interacts with back-end application
servers, either through mod_proxy or using conventional
CGI mechanisms, and may result in request smuggling,
response splitting and cache pollution. (bsc#1016715)
- CVE-2016-4975: Fixed possible CRLF injection allowing
HTTP response splitting attacks for sites which use
mod_userdir. This issue was mitigated by changes which
prohibit CR or LF injection into the 'Location' or other
outbound header key or value. (bsc#1104826) This update
was imported from the SUSE:SLE-12-SP2:Update update
project.
Solution
Update the affected apache2 packages.