CVE-2016-1000111

MEDIUM5.3EPSS 0.58%

Forced Browsing in Twisted

Published: 4/30/2021Modified: 11/18/2024

Also known as:GHSA-3gqj-cmxr-p4x2DEBIAN-CVE-2016-1000111PYSEC-2020-214

Description

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an `httpoxy` issue.

Affected packages (3)

Debian/twistedfrom 0, < 16.4.0-1
PyPI/twistedfrom 0, < 16.3.1
PyPI/twistedfrom 0, < 16.3.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References (9)

ADVISORYhttps://github.com/advisories/GHSA-3gqj-cmxr-p4x2
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1000111
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-1000111
PATCHhttps://github.com/twisted/twisted
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-214.yaml
WEBhttps://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html
WEBhttps://twistedmatrix.com/trac/ticket/8623
WEBhttps://www.openwall.com/lists/oss-security/2016/07/18/6
WEBhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html