CVE-2016-2161

NameCVE-2016-2161
DescriptionIn Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3796-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apache2 (PTS)wheezy2.2.22-13+deb7u6fixed
wheezy (security)2.2.22-13+deb7u12fixed
jessie (security), jessie2.4.10-10+deb8u11fixed
stretch (security), stretch2.4.25-3+deb9u3fixed
buster, sid2.4.29-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
apache2source(unstable)2.4.25-1medium
apache2sourcejessie2.4.10-10+deb8u8mediumDSA-3796-1
apache2sourcewheezy(not affected)

Notes

[wheezy] - apache2 <not-affected> (Vulnerable code introduced in 2.4.x)
https://lists.apache.org/thread.html/139862b41c0dfd5e6e00ad89c00119f9faf0dd41a2f927da9c9a4076@%3Cannounce.httpd.apache.org%3E
Fixed by: https://svn.apache.org/r1772919
Affects: 2.4.1 to 2.4.23
Fixed in 2.4.25

Search for package or bug name: Reporting problems