CVE-2015-3183 The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a....
MediumCVSS 5.0
EPSS 74.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apache2(Debian:12) | < 2.4.16-1 | 2.4.16-1 |
| debian/apache2(Debian:13) | < 2.4.16-1 | 2.4.16-1 |
| debian/apache2(Debian:14) | < 2.4.16-1 | 2.4.16-1 |
| Apache HTTP Server | >= 2.2.0, < 2.2.31 | 2.2.31 |
| Apache HTTP Server | >= 2.4.0, < 2.4.16 | 2.4.16 |
References
- Debian Security Tracker CVE-2015-3183 vendor-advisory
- httpd.apache.org vendor-advisory
- kb.juniper.net third-party-advisory
- APPLE-SA-2015-08-13-2 mailing-list vendor-advisory
- APPLE-SA-2015-09-16-4 mailing-list vendor-advisory
- openSUSE-SU-2015:1684 third-party-advisory vendor-advisory
- HPSBUX03512 mailing-list third-party-advisory vdb-entry vendor-advisory
- RHSA-2015:1666 third-party-advisory vendor-advisory
- RHSA-2015:1667 third-party-advisory vendor-advisory
- RHSA-2015:1668 third-party-advisory vendor-advisory
- RHSA-2015:2661 third-party-advisory vendor-advisory
- RHSA-2016:0061 third-party-advisory vendor-advisory
- RHSA-2016:0062 third-party-advisory vendor-advisory
- RHSA-2016:2054 third-party-advisory vendor-advisory
- RHSA-2016:2055 third-party-advisory vendor-advisory
- RHSA-2016:2056 third-party-advisory vendor-advisory
- www.apache.org vendor-advisory
- DSA-3325 third-party-advisory vendor-advisory
- www.oracle.com patch
- www.oracle.com mailing-list third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory vdb-entry
- 75963 third-party-advisory vdb-entry
- 91787 third-party-advisory vdb-entry
- 1032967 third-party-advisory vdb-entry
- USN-2686-1 third-party-advisory vendor-advisory
- RHSA-2015:2659 third-party-advisory vendor-advisory
- RHSA-2015:2660 third-party-advisory vendor-advisory
- github.com third-party-advisory
- github.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list third-party-advisory
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list third-party-advisory
- puppet.com third-party-advisory
- GLSA-201610-02 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory vdb-entry
- support.apple.com third-party-advisory vdb-entry