REDHAT-BUG-694658
First published: Thu Apr 07 2011(Updated: )
It was reported [1] that tinyproxy prior to version 1.8.3, when configured to allow a network range (i.e. "Allow 192.168.0.0/24" versus the default "Allow 127.0.0.1"), would allow any connections from any IP address, turning it into an open proxy. If tinyproxy were configured with one or more Allow statements that use an IP range, this would occur. This has been fixed upstream [2] and affects the versions of tinyproxy as provided by Fedora and EPEL. [1] <a href="https://banu.com/bugzilla/show_bug.cgi?id=90">https://banu.com/bugzilla/show_bug.cgi?id=90</a> [2] <a href="https://banu.com/cgit/tinyproxy/commit/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4">https://banu.com/cgit/tinyproxy/commit/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tinyproxy | <1.8.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://banu.com/bugzilla/show_bug.cgi?id=90
- https://banu.com/cgit/tinyproxy/commit/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4
- https://access.redhat.com/security/cve/CVE-2011-1499
- https://access.redhat.com/security/cve/CVE-2011-1843
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1843
- https://banu.com/cgit/tinyproxy/diff/?id=97b9984484299b2ce72f8f4fc3706dab8a3a8439
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=701687
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=701688
- https://bugzilla.redhat.com/show_bug.cgi?id=694658
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1499
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/tinyproxy
- canonical/tinyproxy