Scott Geary of VendHQ discovered that the Apache HTTPD server used the
value of the Proxy header from HTTP requests to initialize the
HTTP_PROXY environment variable for CGI scripts, which in turn was
incorrectly used by certain HTTP client implementations to configure the
proxy for outgoing HTTP requests. A remote attacker could possibly use
this flaw to redirect HTTP requests performed by a CGI script to an
attacker-controlled proxy via a malicious HTTP request.
For the stable distribution (jessie), this problem has been fixed in
version 2.4.10-10+deb8u5.
We recommend that you upgrade your apache2 packages.
CPE | Name | Operator | Version |
---|---|---|---|
apache2 | eq | 2.4.10-10 | |
apache2 | eq | 2.4.10-10+deb8u1 | |
apache2 | eq | 2.4.10-10+deb8u2 | |
apache2 | eq | 2.4.10-10+deb8u3 | |
apache2 | eq | 2.4.10-10+deb8u4 |