CVE-2016-1000107: Medium severity Erlang Erlang\/otp vulnerability
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1000107?
CVE-2016-1000107 has a medium severity rating due to its potential to allow remote attackers to manipulate an application's outbound HTTP traffic.
How do I fix CVE-2016-1000107?
To fix CVE-2016-1000107, ensure that you upgrade to a version of Erlang/OTP that is above 22.1.
What applications are affected by CVE-2016-1000107?
CVE-2016-1000107 affects Erlang versions 22.1 and earlier, particularly those using HTTP_PROXY environment variables.
Can CVE-2016-1000107 lead to unauthorized data access?
Yes, CVE-2016-1000107 can lead to unauthorized data access by redirecting outbound HTTP requests to untrusted destinations.
Are all versions of Erlang vulnerable to CVE-2016-1000107?
No, only versions 22.1 and earlier of Erlang/OTP are vulnerable to CVE-2016-1000107.