Your submission was sent successfully! Close

CVE-2016-5388

Published: 18 July 2016

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

Notes

AuthorNote
mdeslaur
setting priority to low, see upstream response for workarounds
for specific environments
Priority

Low

CVSS 3 base score: 8.1

Status

Package Release Status
tomcat6
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise
Released (6.0.35-1ubuntu3.9)
trusty Needed

upstream Needs triage

wily Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needed)
yakkety Does not exist

zesty Does not exist

tomcat7
Launchpad, Ubuntu, Debian
artful Ignored
(reached end-of-life)
bionic Needed

cosmic Ignored
(reached end-of-life)
disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist
(precise was needed)
trusty
Released (7.0.52-1ubuntu0.8)
upstream
Released (7.0.71)
wily Ignored
(reached end-of-life)
xenial Ignored
(end of standard support, was needed)
yakkety Ignored
(reached end-of-life)
zesty Ignored
(reached end-of-life)
Patches:
upstream: https://svn.apache.org/viewvc?view=revision&revision=1756942

tomcat8
Launchpad, Ubuntu, Debian
artful Not vulnerable
(8.0.38-2)
bionic Not vulnerable
(8.0.38-2)
cosmic Not vulnerable
(8.0.38-2)
disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist

trusty Does not exist

upstream
Released (8.0.37)
wily Ignored
(reached end-of-life)
xenial
Released (8.0.32-1ubuntu1.3)
yakkety Not vulnerable
(8.0.37-1)
zesty Not vulnerable
(8.0.38-2)
Patches:

upstream: https://svn.apache.org/viewvc?view=revision&revision=1756941