Advisories » MGASA-2016-0262

Updated apache packages fix security vulnerability

Publication date: 26 Jul 2016
Modification date: 26 Jul 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-5387

Description

It was discovered that httpd used the value of the Proxy header from HTTP
requests to initialize the HTTP_PROXY environment variable for CGI
scripts, which in turn was incorrectly used by certain HTTP client
implementations to configure the proxy for outgoing HTTP requests. A
remote attacker could possibly use this flaw to redirect HTTP requests
performed by a CGI script to an attacker-controlled proxy via a malicious
HTTP request (CVE-2016-5387).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=18991
• https://httpoxy.org/
• https://access.redhat.com/security/vulnerabilities/httpoxy
• http://rhn.redhat.com/errata/RHSA-2016-1422.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5387

SRPMS

5/core

• apache-2.4.10-16.4.mga5