apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression.
| Software | From | Fixed in |
|---|---|---|
| apt-cacher_project / apt-cacher | - | 1.7.13.x |
| apt-cacher-ng_project / apt-cacher-ng | - | 3.3.x |