Bug 1348927 (CVE-2015-8935) - CVE-2015-8935 php: HTTP response splitting in header() function
Summary: CVE-2015-8935 php: HTTP response splitting in header() function
Alias: CVE-2015-8935
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
Blocks: 1348930
TreeView+ depends on / blocked
Reported: 2016-06-22 10:42 UTC by Andrej Nemec
Modified: 2021-10-21 00:53 UTC (History)
12 users (show)

Fixed In Version: php 5.4.38, php 5.5.22, php 5.6.6
Doc Type: If docs needed, set a value
Doc Text:
The header() PHP function allowed header stings containing line break followed by a space or tab, as allowed by RFC 2616. Certain browsers handled the continuation line as new header, making it possible to conduct a HTTP response splitting attack against such browsers. The header() function was updated to follow RFC 7230 and not allow any line breaks.
Clone Of:
Last Closed: 2021-10-21 00:53:30 UTC

Attachments (Terms of Use)

Description Andrej Nemec 2016-06-22 10:42:31 UTC
A vulnerability was found in php. The filtering in header() function is not sufficient and this can lead to header injection and content injection (XSS) when the client is Internet Explorer (in every tested version).

Upstream bug:


Upstream fix:




Comment 1 Tomas Hoger 2016-06-28 13:18:56 UTC
The header() PHP function implements a protection against HTTP response splitting attacks - it does not sent a header if it contains a line break.  There was an exception to this check - line breaks were allowed if followed by space or tab character.  Such behaviour was consistent with RFC 2616 (Hypertext Transfer Protocol -- HTTP/1.1).  Browsers usually treat the second line as a continuation of the previous header line.  According to the information in the upstream PHP bug report, certain browsers, including Internet Explorer, may treat the second line as a new header.

Upstream fix for this issue removes the exception which is no longer allowed by RFC 7230 (Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing), which obsoletes RFC 2616.  The patch was applied in upstream versions 5.4.38, 5.5.22, and 5.6.6.

Note that this change may introduce a regression where code generates headers with trusted content that use continuation syntax.

Comment 2 Tomas Hoger 2016-06-28 13:22:32 UTC
The PHP packages as shipped in php54 collection in Red Hat Software Collections was previously updated to upstream version 5.4.40 via RHSA-2015:1066 and hence already include the fix for this issue.


Note You need to log in before you can comment on or make changes to this bug.