Advisories ยป MGASA-2016-0262

Updated apache packages fix security vulnerability

Publication date: 26 Jul 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-5387


It was discovered that httpd used the value of the Proxy header from HTTP
requests to initialize the HTTP_PROXY environment variable for CGI
scripts, which in turn was incorrectly used by certain HTTP client
implementations to configure the proxy for outgoing HTTP requests. A
remote attacker could possibly use this flaw to redirect HTTP requests
performed by a CGI script to an attacker-controlled proxy via a malicious
HTTP request (CVE-2016-5387).