Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2016-5386
HistoryJul 19, 2016 - 2:00 a.m.

CVE-2016-5386

2016-07-1902:00:18
CWE-284
[email protected]
web.nvd.nist.gov

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.262 Low

EPSS

Percentile

96.8%

JSON

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application’s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an “httpoxy” issue.

Affected configurations

NVD
Node
fedoraprojectfedoraMatch23
OR
fedoraprojectfedoraMatch24
Node
oraclelinuxMatch7
Node
redhatenterprise_linux_serverMatch7.0
OR
redhatenterprise_linux_server_ausMatch7.2
OR
redhatenterprise_linux_server_eusMatch7.2
Node
golanggoRange1.0–1.6.3
OR
golanggoMatch1.7rc1

Related

oraclelinux 1
nessus 10
huawei 1
fedora 2
prion 2
ubuntucve 1
f5 2
openvas 7
mageia 1
cve 2
cvelist 1
osv 1
redhatcve 1
veracode 1
amazon 1
nvd 1
cloudfoundry 1
ibm 3
centos 1
redhat 1
cert 1
checkpoint_advisories 1
threatpost 1
impervablog 1
oracle 1
oraclelinux
oraclelinux
golang security, bug fix, and enhancement update
2016-08-02 00:00:00
nessus
nessus
Scientific Linux Security Update : golang on SL7.x x86_64 (20160803) (httpoxy)
2016-08-04 00:00:00
Amazon Linux AMI : golang (ALAS-2016-731) (httpoxy)
2016-08-18 00:00:00
Fedora 23 : golang (2016-340e361b90) (httpoxy)
2016-07-29 00:00:00
huawei
huawei
Security Advisory - A CGI application vulnerability in Some Huawei Products
2017-11-29 00:00:00
fedora
fedora
[SECURITY] Fedora 23 Update: golang-1.5.4-2.fc23
2016-07-29 02:54:15
[SECURITY] Fedora 24 Update: golang-1.6.3-1.fc24
2016-07-28 23:58:56
prion
prion
Design/Logic Flaw
2016-07-19 02:00:00
Design/Logic Flaw
2016-10-06 14:59:00
ubuntucve
ubuntucve
CVE-2016-5386
2016-07-18 00:00:00
f5
f5
K92930514 : GO vulnerability CVE-2016-5386
2016-07-25 00:00:00
SOL92930514 - GO vulnerability CVE-2016-5386
2016-07-25 00:00:00
openvas
openvas
CentOS Update for golang CESA-2016:1538 centos7
2016-08-08 00:00:00
Mageia: Security Advisory (MGASA-2016-0317)
2022-01-28 00:00:00
Amazon Linux: Security Advisory (ALAS-2016-731)
2016-10-26 00:00:00
mageia
mageia
Updated golang package fixes security vulnerability
2016-09-23 23:57:12
cve
cve
CVE-2016-5386
2016-07-19 02:00:18
CVE-2016-1000101
2016-10-06 14:59:17
cvelist
cvelist
CVE-2016-5386
2016-07-19 01:00:00
osv
osv
Improper input validation in net/http and net/http/cgi
2022-08-09 17:05:15
redhatcve
redhatcve
CVE-2016-5386
2020-04-07 16:54:43
veracode
veracode
HTTPoxy Vulnerability
2017-05-03 02:22:45
amazon
amazon
Medium: golang
2016-08-17 13:30:00
nvd
nvd
CVE-2016-1000101
2016-10-06 14:59:17
cloudfoundry
cloudfoundry
Multiple CVEs: httpoxy | Cloud Foundry
2016-12-21 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect SAN Volume Controller, Storwize family and FlashSystem V9000 products
2023-03-29 01:48:02
Security Bulletin: Vulnerabilities in Apache Tomcat affect the IBM FlashSystem model V840
2018-06-18 00:32:31
Security Bulletin: Vulnerabilities in Apache Tomcat affect the IBM FlashSystem models 840 and 900
2023-02-18 01:45:50
centos
centos
golang security update
2016-08-02 21:57:55
redhat
redhat
(RHSA-2016:1538) Moderate: golang security, bug fix, and enhancement update
2016-08-02 13:46:33
cert
cert
CGI web servers assign Proxy header values from client requests to internal HTTP_PROXY environment variables
2016-07-18 00:00:00
checkpoint_advisories
checkpoint_advisories
CGI Namespace Conflict Man-In-The-Middle (httpoxy; CVE-2016-1000109; CVE-2016-1000110; CVE-2016-5385; CVE-2016-5386; CVE-2016-5387; CVE-2016-5388)
2016-07-19 00:00:00
threatpost
threatpost
CGI Script Vulnerability 'Httpoxy' Allows Man-in-the-Middle Attack
2016-07-18 18:00:46
impervablog
impervablog
Python and Go Top the Chart of 2019’s Most Popular Hacking Tools
2020-05-27 09:22:21
oracle
oracle
Oracle Critical Patch Update Advisory - July 2017
2018-03-20 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.262 Low

EPSS

Percentile

96.8%

JSON
Related for NVD:CVE-2016-5386
oraclelinux1nessus10huawei1fedora2prion2ubuntucve1f52openvas7mageia1cve2cvelist1osv1redhatcve1veracode1amazon1nvd1cloudfoundry1ibm3centos1redhat1cert1checkpoint_advisories1threatpost1impervablog1oracle1