openSUSE 42.3: 2018:2856-1 Moderate: Apache2 Request Smuggling

This update for apache2 fixes the following issues:

Security issues fixed:

- CVE-2016-8743: Fixed liberal whitespace interpretation accepted from

requests and sent in response lines and headers. Accepting these

different behaviors represented a security concern when httpd

participates in any chain of proxies or interacts with back-end

application servers, either through mod_proxy or using conventional CGI

mechanisms, and may result in request smuggling, response splitting and

cache pollution. (bsc#1016715)

- CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response

splitting attacks for sites which use mod_userdir. This issue was

mitigated by changes which prohibit CR or LF injection into the

"Location" or other outbound header key or value. (bsc#1104826)

This update was imported from the SUSE:SLE-12-SP2:Update update project.