NetSight
IP …
high8.1

CVE-2016-5387

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in…

Impact

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.2.0 through 2.2.31
from 2.4.1 through 2.4.23
HpSystem Management Homepage
through 7.5.5.0
OracleCommunications User Data Repository
from 10.0.0 through 12.4
OracleEnterprise Manager Ops Center
Versions 12.2.2, 12.3.2
OracleLinux
Versions 5, 6, 7
OracleSolaris
Version 11.3
FedoraprojectFedora
Versions 23, 24
RedhatJboss Web Server
Version 2.1.0
RedhatJboss Enterprise Web Server
Versions 2.0.0, 3.0.0
RedhatJboss Core Services
Version 1.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 7.2, 7.3, 7.4, 7.5, 7.6, 7.7

References