Published: 11/03/2020 Updated: 13/03/2020

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Twisted prior to 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote malicious users to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
twistedmatrix twisted

Twisted could be made to run programs if it received specially crafted network traffic ...

Synopsis Important: Red Hat Satellite 6 security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat Satellite 62 for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a sec ...

Synopsis Important: python-twisted-web security update Type/Severity Security Advisory: Important Topic An update for python-twisted-web is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A C ...

It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests A remote attacker could possibly use this flaw to redirect HTT ...

Impact: Important Public Date: 2016-07-18 CWE: CWE-20 Bugzilla: 1357345: CVE-2016-1000111 Python Twiste ...

CWE-425 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html https://www.openwall.com/lists/oss-security/2016/07/18/6 https://twistedmatrix.com/trac/ticket/8623 https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html https://usn.ubuntu.com/3585-1/https://nvd.nist.gov

CVE-2016-1000111

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect