CVE-2016-5385 HTTP Proxy header vulnerability
HighCVSS 8.1
EPSS 50.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| guzzlehttp/guzzle(Packagist) | >= 6, < 6.2.1 | 6.2.1 |
| guzzlehttp/guzzle(Packagist) | = 6.0.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 6.0.1 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 6.0.2 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 6.1.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 6.1.1 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 6.2.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | >= 4.0.0-rc2, < 4.2.4 | 4.2.4 |
| guzzlehttp/guzzle(Packagist) | = 4.0.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.0.0-rc.2 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.0.1 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.0.2 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.1 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.2 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.3 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.4 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.5 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.6 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.7 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.1.8 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.2.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.2.1 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.2.2 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 4.2.3 | No fix listed |
Show 132 more
| Product | Affected versions | Fixed in |
|---|---|---|
| guzzlehttp/guzzle(Packagist) | >= 5, < 5.3.1 | 5.3.1 |
| guzzlehttp/guzzle(Packagist) | = 5.0.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 5.0.1 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 5.0.2 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 5.0.3 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 5.1.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 5.2.0 | No fix listed |
| guzzlehttp/guzzle(Packagist) | = 5.3.0 | No fix listed |
| drupal/core(Packagist) | >= 8.0, < 8.1.7 | 8.1.7 |
| drupal/core(Packagist) | = 8.0.0 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta10 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta11 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta12 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta13 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta14 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta15 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta16 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta6 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta7 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta8 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta9 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc2 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc3 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc4 | No fix listed |
| drupal/core(Packagist) | = 8.0.1 | No fix listed |
| drupal/core(Packagist) | = 8.0.2 | No fix listed |
| drupal/core(Packagist) | = 8.0.3 | No fix listed |
| drupal/core(Packagist) | = 8.0.4 | No fix listed |
| drupal/core(Packagist) | = 8.0.5 | No fix listed |
| drupal/core(Packagist) | = 8.0.6 | No fix listed |
| drupal/core(Packagist) | = 8.1.0 | No fix listed |
| drupal/core(Packagist) | = 8.1.0-beta1 | No fix listed |
| drupal/core(Packagist) | = 8.1.0-beta2 | No fix listed |
| drupal/core(Packagist) | = 8.1.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.1.1 | No fix listed |
| drupal/core(Packagist) | = 8.1.2 | No fix listed |
| drupal/core(Packagist) | = 8.1.3 | No fix listed |
| drupal/core(Packagist) | = 8.1.4 | No fix listed |
| drupal/core(Packagist) | = 8.1.5 | No fix listed |
| drupal/core(Packagist) | = 8.1.6 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | < 2.0.2 | 2.0.2 |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.1 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.10 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.2 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.3 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.4 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.5 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.6 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.7 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.8 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.0.9 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.1.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.1.1 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.2.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.2.1 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.3.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.4.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.4.1 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.4.2 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.5.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.5.1 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.6.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.6.1 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.6.2 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.6.3 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.6.4 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v1.7.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v2.0.0 | No fix listed |
| bugsnag/bugsnag-laravel(Packagist) | = v2.0.1 | No fix listed |
| amphp/artax(Packagist) | < 1.0.4 | 1.0.4 |
| amphp/artax(Packagist) | = v0.1.0 | No fix listed |
| amphp/artax(Packagist) | = v0.3.7 | No fix listed |
| amphp/artax(Packagist) | = v0.4.0 | No fix listed |
| amphp/artax(Packagist) | = v0.5.0 | No fix listed |
| amphp/artax(Packagist) | = v0.5.1 | No fix listed |
| amphp/artax(Packagist) | = v0.6.0 | No fix listed |
| amphp/artax(Packagist) | = v0.6.1 | No fix listed |
| amphp/artax(Packagist) | = v0.6.2 | No fix listed |
| amphp/artax(Packagist) | = v0.7.0 | No fix listed |
| amphp/artax(Packagist) | = v0.7.1 | No fix listed |
| amphp/artax(Packagist) | = v1.0.0 | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-alpha | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-beta | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-beta2 | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-rc1 | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-rc2 | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-rc3 | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-rc4 | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-rc5 | No fix listed |
| amphp/artax(Packagist) | = v1.0.0-rc6 | No fix listed |
| amphp/artax(Packagist) | = v1.0.1 | No fix listed |
| amphp/artax(Packagist) | = v1.0.2 | No fix listed |
| amphp/artax(Packagist) | = v1.0.3 | No fix listed |
| amphp/artax(Packagist) | >= 2.0.0, < 2.0.4 | 2.0.4 |
| amphp/artax(Packagist) | = 2.0.2 | No fix listed |
| amphp/artax(Packagist) | = v2.0.0 | No fix listed |
| amphp/artax(Packagist) | = v2.0.1 | No fix listed |
| amphp/artax(Packagist) | = v2.0.3 | No fix listed |
| padraic/humbug_get_contents(Packagist) | < 1.1.2 | 1.1.2 |
| padraic/humbug_get_contents(Packagist) | = 1.0.0 | No fix listed |
| padraic/humbug_get_contents(Packagist) | = 1.0.1 | No fix listed |
| padraic/humbug_get_contents(Packagist) | = 1.0.2 | No fix listed |
| padraic/humbug_get_contents(Packagist) | = 1.0.3 | No fix listed |
| padraic/humbug_get_contents(Packagist) | = 1.0.4 | No fix listed |
| padraic/humbug_get_contents(Packagist) | = 1.1.0 | No fix listed |
| padraic/humbug_get_contents(Packagist) | = 1.1.1 | No fix listed |
| amphp/artax(Packagist) | >= 0.7.1, < 1.0.4 | 1.0.4 |
| bugsnag/bugsnag-laravel(Packagist) | >= 2, < 2.0.2 | 2.0.2 |
| drupal/drupal(Packagist) | >= 8.0, < 8.1.7 | 8.1.7 |
| typo3/cms(Packagist) | >= 8.0.0, < 8.2.1 | 8.2.1 |
| oracle communications user data repository | = 10.0.0 | No fix listed |
| oracle communications user data repository | = 10.0.1 | No fix listed |
| oracle communications user data repository | = 12.0.0 | No fix listed |
| oracle enterprise manager ops center | = 12.2.2 | No fix listed |
| oracle enterprise manager ops center | = 12.3.2 | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| HP Inc storeever msl6480 tape library firmware | <= 5.09 | No fix listed |
| HP Inc system management homepage | <= 7.5.5.0 | No fix listed |
| PHP | >= 5.5.0, < 5.5.38 | 5.5.38 |
| PHP | >= 5.6.0, < 5.6.24 | 5.6.24 |
| PHP | >= 7.0.0, <= 7.0.8 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| drupal/drupal | >= 8.0.0, < 8.1.7 | 8.1.7 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- github.com exploit
- github.com
- github.com
- github.com
- github.com
- github.com release-notes third-party-advisory
- github.com
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- FEDORA-2016-8eb11666aa vendor-advisory
- FEDORA-2016-9c8cf5912c vendor-advisory
- FEDORA-2016-4e7db3d437 vendor-advisory
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- GLSA-201611-22 third-party-advisory vendor-advisory
- www.drupal.org third-party-advisory
- openSUSE-SU-2016:1922 third-party-advisory vendor-advisory
- RHSA-2016:1609 broken-link third-party-advisory vendor-advisory
- RHSA-2016:1610 broken-link third-party-advisory vendor-advisory
- RHSA-2016:1611 broken-link third-party-advisory vendor-advisory
- RHSA-2016:1612 broken-link third-party-advisory vendor-advisory
- RHSA-2016:1613 broken-link third-party-advisory vendor-advisory
- DSA-3631 third-party-advisory vendor-advisory
- VU#797896 third-party-advisory us-government-resource
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory
- 91821 third-party-advisory vdb-entry
- 1036335 third-party-advisory vdb-entry
- github.com exploit
- github.com exploit
- github.com exploit
- github.com exploit
- github.com exploit
- github.com exploit
- httpoxy.org third-party-advisory
- twitter.com
- typo3.org
- github.com