CVE-2016-5387
19.07.2016, 02:00
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| apache | http_server | 2.2.0 ≤ 𝑥 ≤ 2.2.31 |
| apache | http_server | 2.4.1 ≤ 𝑥 ≤ 2.4.23 |
| hp | system_management_homepage | 𝑥 ≤ 7.5.5.0 |
| oracle | communications_user_data_repository | 10.0.0 ≤ 𝑥 ≤ 12.4 |
| oracle | enterprise_manager_ops_center | 12.2.2 |
| oracle | enterprise_manager_ops_center | 12.3.2 |
| oracle | solaris | 11.3 |
| redhat | jboss_web_server | 2.1.0 |
| redhat | jboss_enterprise_web_server | 2.0.0 |
| redhat | jboss_enterprise_web_server | 3.0.0 |
| redhat | jboss_enterprise_web_server | 2.0.0 |
| redhat | jboss_enterprise_web_server | 3.0.0 |
| redhat | jboss_core_services | 1.0 |
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_eus | 7.2 |
| redhat | enterprise_linux_eus | 7.3 |
| redhat | enterprise_linux_eus | 7.4 |
| redhat | enterprise_linux_eus | 7.5 |
| redhat | enterprise_linux_eus | 7.6 |
| redhat | enterprise_linux_eus | 7.7 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_server_aus | 7.2 |
| redhat | enterprise_linux_server_aus | 7.3 |
| redhat | enterprise_linux_server_aus | 7.4 |
| redhat | enterprise_linux_server_aus | 7.6 |
| redhat | enterprise_linux_server_aus | 7.7 |
| redhat | enterprise_linux_server_tus | 7.2 |
| redhat | enterprise_linux_server_tus | 7.3 |
| redhat | enterprise_linux_server_tus | 7.6 |
| redhat | enterprise_linux_server_tus | 7.7 |
| redhat | enterprise_linux_workstation | 6.0 |
| redhat | enterprise_linux_workstation | 7.0 |
| debian | debian_linux | 8.0 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 15.10 |
| canonical | ubuntu_linux | 16.04 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 13.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache2 |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| apache2-devel |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| apache2-doc |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| apache2-example-pages |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| apache2-prefork |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| apache2-utils |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| apache2-worker |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||
|---|---|---|---|---|---|
| httpd |
| ||||
| httpd-devel |
| ||||
| httpd-manual |
| ||||
| httpd-tools |
| ||||
| mod |
|
References