CVE-2016-1000111
First published: Wed Mar 11 2020(Updated: )
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an `httpoxy` issue.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Twistedmatrix Twisted | <16.3.1 | |
| pip/twisted | <16.3.1 | 16.3.1 |
| Twisted Twisted | <16.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000111
- https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html
- https://twistedmatrix.com/trac/ticket/8623
- https://www.openwall.com/lists/oss-security/2016/07/18/6
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- https://github.com/advisories/GHSA-3gqj-cmxr-p4x2 (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-214.yaml
Frequently Asked Questions
What is the vulnerability ID of this CVE?
The vulnerability ID of this CVE is CVE-2016-1000111.
What is the severity level of CVE-2016-1000111?
The severity level of CVE-2016-1000111 is medium (5.3).
How does CVE-2016-1000111 affect Twisted?
CVE-2016-1000111 affects Twisted before version 16.3.1.
What is the CWE ID associated with CVE-2016-1000111?
The CWE ID associated with CVE-2016-1000111 is CWE-425.
Are there any references for CVE-2016-1000111?
Yes, you can find references for CVE-2016-1000111 at the following links: - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-1000111) - [Twistedmatrix](https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html) - [Twistedmatrix Trac](https://twistedmatrix.com/trac/ticket/8623)
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/remedy
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3gqj-cmxr-p4x2
- alias/CVE-2016-1000111
- agent/software-canonical-lookup
- agent/references
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/nvd-api
- agent/author
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/twistedmatrix
- canonical/twistedmatrix twisted
- package-manager/pip
- vendor/twisted
- canonical/twisted twisted