CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.
CVE-2006-3918
Description
From CVE.org
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
- Bugzilla 200732: httpd: Expect header XSS
- CWE-79: Improper Neutralization of Input During Web Page Generation
- FAQ: Frequently asked questions about CVE-2006-3918
Frequently Asked Questions
For more information, see https://access.redhat.com/solutions/762393.
- "Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.
- The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.
Available options depend mostly on the Impact of the vulnerability and the current Life Cycle phase of your product. Overall, you have the following options:
- Upgrade to a supported product version that includes a fix for this vulnerability (recommended).
- Apply a mitigation (if one exists).
- Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.
Available options depend mostly on the Impact of the vulnerability and the current Life Cycle phase of your product. Overall, you have the following options:
- Apply a mitigation (if one exists).
- Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.
- Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
For clarification or corrections, please contact Red Hat Product Security.
Last modified:
CVE description copyright © 2021, The MITRE Corporation
