CVE-2016-8743 Amazon Linux Security Advisory for httpd: ALAS-2017-851

Apache HTTP Request Parsing Whitespace Defects
It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning.(CVE-2016-8743 )

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2017-851 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2017-851: Amazon Linux (httpd (2.2.32-1.9.amzn1) on noarch)

ALAS-2017-851: Amazon Linux (httpd (2.2.32-1.9.amzn1) on x86_64)

ALAS-2017-851: Amazon Linux (httpd (2.2.32-1.9.amzn1) on src)

ALAS-2017-851: Amazon Linux (httpd (2.2.32-1.9.amzn1) on i686)