Summary
It was discovered that the Apache HTTP Server would set the HTTP_PROXY
environment variable based on the contents of the Proxy header from HTTP
requests. A remote attacker could possibly use this issue in combination
with CGI scripts that honour the HTTP_PROXY variable to redirect outgoing
HTTP requests.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | apache2 | 2.4.7-1ubuntu4.13 |
| Ubuntu · 16.04 LTS 16.04:LTS | apache2 | 2.4.18-2ubuntu3.1 |
Vulnerabilities 1
-
Unscored —CVE-2016-5387 EPSS 56%
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from …
References
-
report
https://ubuntu.com/security/CVE-2016-5387