CVE-2016-1000108: Medium severity Yaws Yaws vulnerability
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1000108?
CVE-2016-1000108 is considered a moderate severity vulnerability due to the potential for remote attackers to manipulate CGI applications.
How do I fix CVE-2016-1000108?
To fix CVE-2016-1000108, upgrade yaws to version 2.0.8+dfsg-3 or later.
What systems are affected by CVE-2016-1000108?
CVE-2016-1000108 affects yaws versions prior to 2.0.4 on Debian GNU/Linux systems.
What kind of attack does CVE-2016-1000108 enable?
CVE-2016-1000108 allows attackers to redirect a CGI application's outbound HTTP requests by exploiting untrusted client data.
Is CVE-2016-1000108 related to specific RFC guidelines?
Yes, CVE-2016-1000108 does not comply with RFC 3875 section 4.1.18 regarding namespace conflicts.