Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2016-5386
HistoryJul 19, 2016 - 2:00 a.m.

CVE-2016-5386

2016-07-1902:00:00
CWE-284
[email protected]
web.nvd.nist.gov
57
5
cve-2016-5386
net/http
go
rfc 3875
cgi
http_proxy
httpoxy
security issue
nvd

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.236 Low

EPSS

Percentile

96.5%

JSON

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application’s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an “httpoxy” issue.

Social References

More

Related

nessus 10
oraclelinux 1
huawei 1
fedora 2
prion 2
ubuntucve 1
f5 2
mageia 1
openvas 7
veracode 1
redhatcve 1
amazon 1
osv 1
cve 1
cloudfoundry 1
ibm 3
centos 1
redhat 1
checkpoint_advisories 1
cert 1
threatpost 1
impervablog 1
oracle 1
nessus
nessus
Scientific Linux Security Update : golang on SL7.x x86_64 (20160803) (httpoxy)
2016-08-04 00:00:00
Amazon Linux AMI : golang (ALAS-2016-731) (httpoxy)
2016-08-18 00:00:00
openSUSE Security Update : go (openSUSE-2016-979) (httpoxy)
2016-08-12 00:00:00
oraclelinux
oraclelinux
golang security, bug fix, and enhancement update
2016-08-02 00:00:00
huawei
huawei
Security Advisory - A CGI application vulnerability in Some Huawei Products
2017-11-29 00:00:00
fedora
fedora
[SECURITY] Fedora 23 Update: golang-1.5.4-2.fc23
2016-07-29 02:54:15
[SECURITY] Fedora 24 Update: golang-1.6.3-1.fc24
2016-07-28 23:58:56
prion
prion
Design/Logic Flaw
2016-07-19 02:00:00
Design/Logic Flaw
2016-10-06 14:59:00
ubuntucve
ubuntucve
CVE-2016-5386
2016-07-18 00:00:00
f5
f5
K92930514 : GO vulnerability CVE-2016-5386
2016-07-25 00:00:00
SOL92930514 - GO vulnerability CVE-2016-5386
2016-07-25 00:00:00
mageia
mageia
Updated golang package fixes security vulnerability
2016-09-23 23:57:12
openvas
openvas
CentOS Update for golang CESA-2016:1538 centos7
2016-08-08 00:00:00
Mageia: Security Advisory (MGASA-2016-0317)
2022-01-28 00:00:00
Fedora Update for golang FEDORA-2016-340e361b90
2016-08-04 00:00:00
veracode
veracode
HTTPoxy Vulnerability
2017-05-03 02:22:45
redhatcve
redhatcve
CVE-2016-5386
2020-04-07 16:54:43
amazon
amazon
Medium: golang
2016-08-17 13:30:00
osv
osv
Improper input validation in net/http and net/http/cgi
2022-08-09 17:05:15
cve
cve
CVE-2016-1000101
2016-10-06 14:59:00
cloudfoundry
cloudfoundry
Multiple CVEs: httpoxy | Cloud Foundry
2016-12-21 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect SAN Volume Controller, Storwize family and FlashSystem V9000 products
2023-03-29 01:48:02
Security Bulletin: Vulnerabilities in Apache Tomcat affect the IBM FlashSystem models 840 and 900
2023-02-18 01:45:50
Security Bulletin: Vulnerabilities in Apache Tomcat affect the IBM FlashSystem model V840
2018-06-18 00:32:31
centos
centos
golang security update
2016-08-02 21:57:55
redhat
redhat
(RHSA-2016:1538) Moderate: golang security, bug fix, and enhancement update
2016-08-02 13:46:33
checkpoint_advisories
checkpoint_advisories
CGI Namespace Conflict Man-In-The-Middle (httpoxy; CVE-2016-1000109; CVE-2016-1000110; CVE-2016-5385; CVE-2016-5386; CVE-2016-5387; CVE-2016-5388)
2016-07-19 00:00:00
cert
cert
CGI web servers assign Proxy header values from client requests to internal HTTP_PROXY environment variables
2016-07-18 00:00:00
threatpost
threatpost
CGI Script Vulnerability 'Httpoxy' Allows Man-in-the-Middle Attack
2016-07-18 18:00:46
impervablog
impervablog
Python and Go Top the Chart of 2019’s Most Popular Hacking Tools
2020-05-27 09:22:21
oracle
oracle
Oracle Critical Patch Update Advisory - July 2017
2018-03-20 00:00:00

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.236 Low

EPSS

Percentile

96.5%

JSON
Related for CVE-2016-5386
nessus10oraclelinux1huawei1fedora2prion2ubuntucve1f52mageia1openvas7veracode1redhatcve1amazon1osv1cve1cloudfoundry1ibm3centos1redhat1checkpoint_advisories1cert1threatpost1impervablog1oracle1