Input validation error in apache2 (Alpine package)
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2015-3183 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
apache2 (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Input validation error
EUVDB-ID: #VU33821
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2015-3183
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.
MitigationInstall update from vendor's website.
Vulnerable software versionsapache2 (Alpine package): 2.4.4-r0 - 2.4.12-r1
External linkshttp://git.alpinelinux.org/aports/commit/?id=db992fcd384a88b087cf614ea6085a7618361f3a
http://git.alpinelinux.org/aports/commit/?id=7a5b508efbcc2243c09bd0b060136f78409d3ab7
http://git.alpinelinux.org/aports/commit/?id=b1db34556bafee5506f78b45c1a6f88844d89508
http://git.alpinelinux.org/aports/commit/?id=b785b5f3aa75162cd033fd8dc922f4e2a5fd770e
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
