CVE-2016-1000108
First published: Tue Dec 10 2019(Updated: )
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/yaws | 2.0.8+dfsg-3 2.1.1+dfsg-2 2.2.0+dfsg-1 | |
| Yaws | <2.0.4 | |
| Debian Linux | =8.0 | |
| Debian Linux | =9.0 | |
| Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2016/07/18/6
- https://github.com/klacke/yaws/commit/9d8fb070e782c95821c90d0ca7372fc6d7316c78#diff-54053c47eb173a90c26ed19bd9d106c1
- https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000108.json
- https://security-tracker.debian.org/tracker/CVE-2016-1000108
Frequently Asked Questions
What is the severity of CVE-2016-1000108?
CVE-2016-1000108 is considered a moderate severity vulnerability due to the potential for remote attackers to manipulate CGI applications.
How do I fix CVE-2016-1000108?
To fix CVE-2016-1000108, upgrade yaws to version 2.0.8+dfsg-3 or later.
What systems are affected by CVE-2016-1000108?
CVE-2016-1000108 affects yaws versions prior to 2.0.4 on Debian GNU/Linux systems.
What kind of attack does CVE-2016-1000108 enable?
CVE-2016-1000108 allows attackers to redirect a CGI application's outbound HTTP requests by exploiting untrusted client data.
Is CVE-2016-1000108 related to specific RFC guidelines?
Yes, CVE-2016-1000108 does not comply with RFC 3875 section 4.1.18 regarding namespace conflicts.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/remedy
- agent/description
- agent/event
- agent/first-publish-date
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/yaws
- canonical/yaws
- vendor/debian
- canonical/debian linux
- version/debian linux/8.0
- version/debian linux/9.0
- version/debian linux/10.0