CVE-2016-4975

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-4975
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4975.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-4975
Downstream
Related
Published
2018-08-14T12:29:00.220Z
Modified
2026-07-08T12:54:06.494581Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).

References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
cd3e5a83cd5765d12b3237631c829eaff80f8425
Last affected
ef07cb031c6f8f7ac483c26fc858aad68c365fd9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.2.0"
        },
        {
            "last_affected": "2.2.0"
        },
        {
            "introduced": "2.2.2"
        },
        {
            "last_affected": "2.2.2"
        },
        {
            "introduced": "2.2.3"
        },
        {
            "last_affected": "2.2.3"
        },
        {
            "introduced": "2.2.4"
        },
        {
            "last_affected": "2.2.4"
        },
        {
            "introduced": "2.2.6"
        },
        {
            "last_affected": "2.2.6"
        },
        {
            "introduced": "2.2.8"
        },
        {
            "last_affected": "2.2.8"
        },
        {
            "introduced": "2.2.9"
        },
        {
            "last_affected": "2.2.9"
        },
        {
            "introduced": "2.2.10"
        },
        {
            "last_affected": "2.2.10"
        },
        {
            "introduced": "2.2.11"
        },
        {
            "last_affected": "2.2.11"
        },
        {
            "introduced": "2.2.12"
        },
        {
            "last_affected": "2.2.12"
        },
        {
            "introduced": "2.2.13"
        },
        {
            "last_affected": "2.2.13"
        },
        {
            "introduced": "2.2.14"
        },
        {
            "last_affected": "2.2.14"
        },
        {
            "introduced": "2.2.15"
        },
        {
            "last_affected": "2.2.15"
        },
        {
            "introduced": "2.2.16"
        },
        {
            "last_affected": "2.2.16"
        },
        {
            "introduced": "2.2.17"
        },
        {
            "last_affected": "2.2.17"
        },
        {
            "introduced": "2.2.18"
        },
        {
            "last_affected": "2.2.18"
        },
        {
            "introduced": "2.2.19"
        },
        {
            "last_affected": "2.2.19"
        },
        {
            "introduced": "2.2.20"
        },
        {
            "last_affected": "2.2.20"
        },
        {
            "introduced": "2.2.21"
        },
        {
            "last_affected": "2.2.21"
        },
        {
            "introduced": "2.2.22"
        },
        {
            "last_affected": "2.2.22"
        },
        {
            "introduced": "2.2.23"
        },
        {
            "last_affected": "2.2.23"
        },
        {
            "introduced": "2.2.24"
        },
        {
            "last_affected": "2.2.24"
        },
        {
            "introduced": "2.2.25"
        },
        {
            "last_affected": "2.2.25"
        },
        {
            "introduced": "2.2.26"
        },
        {
            "last_affected": "2.2.26"
        },
        {
            "introduced": "2.2.27"
        },
        {
            "last_affected": "2.2.27"
        },
        {
            "introduced": "2.2.29"
        },
        {
            "last_affected": "2.2.29"
        },
        {
            "introduced": "2.2.31"
        },
        {
            "last_affected": "2.2.31"
        },
        {
            "introduced": "2.4.1"
        },
        {
            "last_affected": "2.4.1"
        },
        {
            "introduced": "2.4.2"
        },
        {
            "last_affected": "2.4.2"
        },
        {
            "introduced": "2.4.3"
        },
        {
            "last_affected": "2.4.3"
        },
        {
            "introduced": "2.4.4"
        },
        {
            "last_affected": "2.4.4"
        },
        {
            "introduced": "2.4.6"
        },
        {
            "last_affected": "2.4.6"
        },
        {
            "introduced": "2.4.7"
        },
        {
            "last_affected": "2.4.7"
        },
        {
            "introduced": "2.4.9"
        },
        {
            "last_affected": "2.4.9"
        },
        {
            "introduced": "2.4.10"
        },
        {
            "last_affected": "2.4.10"
        },
        {
            "introduced": "2.4.12"
        },
        {
            "last_affected": "2.4.12"
        },
        {
            "introduced": "2.4.16"
        },
        {
            "last_affected": "2.4.16"
        },
        {
            "introduced": "2.4.17"
        },
        {
            "last_affected": "2.4.17"
        },
        {
            "introduced": "2.4.18"
        },
        {
            "last_affected": "2.4.18"
        },
        {
            "introduced": "2.4.20"
        },
        {
            "last_affected": "2.4.20"
        },
        {
            "introduced": "2.4.23"
        },
        {
            "last_affected": "2.4.23"
        }
    ],
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.22:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.23:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.24:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.25:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.26:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.27:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.29:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.2.31:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*"
    ]
}

Affected versions

2.*
2.2.0
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.21
2.2.22
2.2.23
2.2.24
2.2.25
2.2.26
2.2.27
2.2.29
2.2.3
2.2.31
2.2.4
2.2.6
2.2.8
2.2.9
2.4.1
2.4.10
2.4.12
2.4.16
2.4.17
2.4.18
2.4.2
2.4.20
2.4.23
2.4.3
2.4.4
2.4.6
2.4.7
2.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4975.json"