NetSight
IP …
medium5.0

CVE-2013-5704

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer p…

Impact

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

Affected products

VendorProductAffected versions
ApacheHttp Server
Versions 2.2.0, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 7.3, 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.3, 7.6, 7.7
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
RedhatJboss Enterprise Web Server
Versions 3.0.0, 2.0.0
OracleEnterprise Manager Ops Center
before 12.1.4
Versions 12.1.4, 12.2.0, 12.2.1, 12.3.0
OracleHttp Server
Versions 10.1.3.5.0, 11.1.1.7.0, 12.1.2.0, 12.1.3.0
OracleLinux
Version 6
OracleSolaris
Version 11.2

References