CVE-2016-5387

Publication date 18 July 2016

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application’s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an “httpoxy” issue. NOTE: the vendor states “This mitigation has been assigned the identifier CVE-2016-5387″; in other words, this is not a CVE ID for a vulnerability.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	16.04 LTS xenial	Fixed 2.4.18-2ubuntu3.1
	15.10 wily	Fixed 2.4.12-2ubuntu2.1
	14.04 LTS trusty	Fixed 2.4.7-1ubuntu4.13
	12.04 LTS precise	Fixed 2.2.22-1ubuntu1.11

Severity score breakdown

Parameter	Value
Base score	8.1 · High
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)