PI88232: ALLOW THE SERVER TO HANDLE REQUESTS WITH OBSOLETE FOLDS CONTAINING ONLY SPACES AND/OR TABS AFTER PI73984.

Fixes are available

APAR status

Closed as new function.

Error description

Requests with obsolete folds containing only spaces and/or tabs
are rejected by the server with a 400 error after PI73984. For
example, a header My-Header with a value of 'Test\r\n  ' would
be rejected.

A configuration option was added to allow the server to either
allow or deny such requests.

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  Users of IBM HTTP Server (powered by        *
*                  Apache)                                     *
****************************************************************
* PROBLEM DESCRIPTION: Requests with obsolete folds containing *
*                      only spaces and/or tabs are rejected by *
*                      the server with a 400 error after       *
*                      PI73984.                                *
****************************************************************
* RECOMMENDATION:  The application that is sending empty       *
*                  obsolete folds should be modified to not do *
*                  so as it is not compliant with the HTTP 1.1 *
*                  specification.                              *
****************************************************************
Requests with obsolete folds containing only spaces and/or tabs
are rejected by the server with a 400 error after PI73984 (CVE-
2016-8743).
A header My-Header, for example, with a value of 'Test\r\n  '
would be rejected.

Problem conclusion

A configuration option was added to the IBM HTTP Server to allow
the server to either allow or deny such requests. This can be
configured using the HttpProtocolOptions directive and specify
the 'AllowEmptyFoldedLines' option. Another option
'DenyEmptyFoldedLines' was also added to deny handling requests
with empty folded lines.

This fix is targeted for IBM HTTP Server fix packs:
- 9.0.0.6
- 8.5.5.13
- 8.0.0.15
- 7.0.0.45

Temporary fix

Comments

APAR Information

APAR number
PI88232
Reported component name
IBM HTTP SERVER
Reported component ID
5724J0801
Reported release
900
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2017-10-03
Closed date
2017-10-10
Last modified date
2017-10-13

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
IBM HTTP SERVER
Fixed component ID
5724J0801

Applicable component levels

R700 PSY
UP
R800 PSY
UP
R850 PSY
UP
R900 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"9.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
07 September 2022

Tips

PI88232: ALLOW THE SERVER TO HANDLE REQUESTS WITH OBSOLETE FOLDS CONTAINING ONLY SPACES AND/OR TABS AFTER PI73984.

Fixes are available

Subscribe

APAR status

Closed as new function.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

R800 PSY

R850 PSY

R900 PSY

Document Information

Share your feedback

Need support?