CVEvulnerability

CVE-2016-5387

8.1 HIGH Published 2016-07-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-07-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

Affected configurations

• apache http server (>= 2.2.0 <= 2.2.31) • apache http server (>= 2.4.1 <= 2.4.23) • hp system management homepage (<= 7.5.5.0) • oracle communications user data repository (>= 10.0.0 <= 12.4) • oracle enterprise manager ops center 12.2.2 • oracle enterprise manager ops center 12.3.2 • oracle linux 5 • oracle linux 6 • oracle linux 7 • oracle solaris 11.3 • fedoraproject fedora 23 • fedoraproject fedora 24 • redhat jboss web server 2.1.0 • redhat jboss enterprise web server 2.0.0 • redhat jboss enterprise web server 3.0.0 • redhat jboss core services 1.0 • redhat enterprise linux desktop 6.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux eus 7.2 • redhat enterprise linux eus 7.3 • redhat enterprise linux eus 7.4 • redhat enterprise linux eus 7.5 • redhat enterprise linux eus 7.6 • redhat enterprise linux eus 7.7 • redhat enterprise linux server 6.0 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.2 • redhat enterprise linux server aus 7.3 • redhat enterprise linux server aus 7.4 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server aus 7.7 • redhat enterprise linux server tus 7.2 • redhat enterprise linux server tus 7.3 • redhat enterprise linux server tus 7.6 • redhat enterprise linux server tus 7.7 • redhat enterprise linux workstation 6.0 • redhat enterprise linux workstation 7.0 • debian debian linux 8.0 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 15.10 • canonical ubuntu linux 16.04 • opensuse leap 42.1 • opensuse opensuse 13.2

References