REDHAT-BUG-694658: Low severity tinyproxy vulnerability
It was reported [1] that tinyproxy prior to version 1.8.3, when configured to allow a network range (i.e. "Allow 192.168.0.0/24" versus the default "Allow 127.0.0.1"), would allow any connections from any IP address, turning it into an open proxy. If tinyproxy were configured with one or more Allow statements that use an IP range, this would occur.
This has been fixed upstream [2] and affects the versions of tinyproxy as provided by Fedora and EPEL.
[1] https://banu.com/bugzilla/showbug.cgi?id=90 [2] https://banu.com/cgit/tinyproxy/commit/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-694658?
The vulnerability REDHAT-BUG-694658 is considered critical as it can allow unauthorized access to the proxy server.
How do I fix REDHAT-BUG-694658?
To fix REDHAT-BUG-694658, update Tinyproxy to version 1.8.3 or later.
What does REDHAT-BUG-694658 affect?
REDHAT-BUG-694658 affects Tinyproxy versions prior to 1.8.3 when configured to allow network ranges.
What is the impact of REDHAT-BUG-694658?
The impact of REDHAT-BUG-694658 is that it can turn the Tinyproxy server into an open proxy, exposing it to abuse and unauthorized use.
How can I identify if my system is vulnerable to REDHAT-BUG-694658?
You can identify if your system is vulnerable to REDHAT-BUG-694658 by checking if Tinyproxy is running a version older than 1.8.3 and is configured to allow external network ranges.