BSA-2017-115

Security Advisory ID : BSA-2017-115 Component : Apache HTTPD Revision : 2.0: Final The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow...

Debian DLA-749-1 : php5 security update (httpoxy)

CVE-2016-5385 PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's...

Amazon Linux: Security Advisory (ALAS-2016-722)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES11 Security Update : python (SUSE-SU-2016:2270-1) (httpoxy)

This update for python fixes the following issues : - CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack bsc984751 - CVE-2016-5699: incorrect validation of HTTP headers allow header injection bsc985348 - CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding...

SUSE-SU-2016:2270-1 Security update for python

This update for python fixes the following issues: - CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack bsc984751 - CVE-2016-5699: incorrect validation of HTTP headers allow header injection bsc985348 - CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding...

SUSE-SU-2016:2106-1 Security update for python

This update for python fixes the following issues: - CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack bsc984751 - CVE-2016-5636: heap overflow when importing malformed zip files bsc985177 - CVE-2016-5699: incorrect validation of HTTP headers allow header injection bsc985348 -...

Oracle Linux 6 : php (ELSA-2016-1609)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1609 advisory. 5.3.3-48 - don't set environmental variable based on user supplied Proxy request header CVE-2016-5385 Tenable has extracted the preceding description block...

Fedora 23 : perl-CGI-Emulate-PSGI (2016-a29c65b00f) (httpoxy)

This updates bumps perl-CGI-Emulate-PSGI to version 0.22 which removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Fedora 24 : perl-CGI-Emulate-PSGI (2016-683d0b257b) (httpoxy)

This updates bumps perl-CGI-Emulate-PSGI to version 0.22 which removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)

The web application running on the remote web server is affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTPPROXY environment variable is set based on untrusted user data in t...

Debian DLA-553-1 : apache2 security update (httpoxy)

Scott Geary of VendHQ discovered that the Apache HTTPD server used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP...

Medium: tomcat6, tomcat7, tomcat8

Issue Overview: Tomcat's CGI support used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attack...

ALPINE-CVE-2016-5387

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary...

PHP suffers from httpoxy remote proxy infection vulnerability

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. httpoxy is a set of vulnerabilities that affect application code running in a CGI environment. The vulnerabilities exist primarily in multiple w...

Apache Tomcat suffers from httpoxy remote proxy infection vulnerability

Apache Tomcat is the United States Apache Apache Software Foundation under the Jakarta project of a lightweight Web application server, which is mainly used for the development and debugging of JSP programs for small and medium-sized systems. httpoxy is a set of vulnerabilities that affect...

Facebook HHVM suffers from httpoxy remote proxy infection vulnerability

HHWM HipHop VM is a virtual machine launched by Facebook to execute PHP code. httpoxy is a set of vulnerabilities that affect application code running in a CGI environment. The vulnerabilities exist primarily in multiple web servers, web frameworks, and programming languages. The Proxy field name...

RHEL 7 : httpd (RHSA-2016:1422) (httpoxy)

An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20160718) (httpoxy)

Security Fixes : - It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A...

Apache HTTP Server suffers from httpoxy remote proxy infection vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. httpoxy is a set of vulnerabilities that affect application code running in a CGI environment. The vulnerabilities exist...

Python has a httpoxy remote proxy infection vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. httpoxy is a set of vulnerabilities that affect application code running in a CGI environment. The vulnerabilities exist primarily in multiple web servers, web frameworks, and programming languages...