CVE-2016-5388

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI
Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not
protect applications from the presence of untrusted client data in the
HTTP_PROXY environment variable, which might allow remote attackers to
redirect an application’s outbound HTTP traffic to an arbitrary proxy
server via a crafted Proxy header in an HTTP request, aka an “httpoxy”
issue. NOTE: the vendor states “A mitigation is planned for future releases
of Tomcat, tracked as CVE-2016-5388”; in other words, this is not a CVE ID
for a vulnerability.

Notes