CVE-2016-1000111

MEDIUM5.3EPSS 0.58%

Forced Browsing in Twisted

發布日:2021/4/30修改日:2024/11/18

也稱為:GHSA-3gqj-cmxr-p4x2DEBIAN-CVE-2016-1000111PYSEC-2020-214

描述

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an `httpoxy` issue.

受影響套件(3)

Debian/twistedfrom 0, < 16.4.0-1
PyPI/twistedfrom 0, < 16.3.1
PyPI/twistedfrom 0, < 16.3.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

參考連結(9)

ADVISORYhttps://github.com/advisories/GHSA-3gqj-cmxr-p4x2
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1000111
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-1000111
PATCHhttps://github.com/twisted/twisted
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-214.yaml
WEBhttps://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html
WEBhttps://twistedmatrix.com/trac/ticket/8623
WEBhttps://www.openwall.com/lists/oss-security/2016/07/18/6
WEBhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html