CVE-2016-5388 Improper Access Control in Apache Tomcat
HighCVSS 8.1
EPSS 50.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat/tomcat-catalina(Maven) | >= 7.0.0, < 7.0.72 | 7.0.72 |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.0 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.11 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.12 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.14 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.16 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.19 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.2 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.20 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.21 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.22 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.23 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.25 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.26 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.27 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.28 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.29 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.30 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.32 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.33 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.34 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.35 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.37 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.39 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.4 | No fix listed |
Show 88 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.40 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.5 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.6 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.63 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.64 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.65 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.67 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.68 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.69 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.70 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 7.0.8 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | >= 8.0.0, < 8.5.5 | 8.5.5 |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.1 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.11 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.12 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.14 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.15 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.17 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.18 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.20 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.21 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.22 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.23 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.24 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.26 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.27 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.28 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.29 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.3 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.30 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.32 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.33 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.35 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.36 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.37 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.38 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.39 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.41 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.42 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.43 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.44 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.45 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.46 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.47 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.48 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.49 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.5 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.50 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.51 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.52 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.53 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.8 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.0.9 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.0 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat/tomcat-catalina(Maven) | = 8.5.4 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 6.0 | No fix listed |
| redhat enterprise linux hpc node eus | = 7.2 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.2 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| HP Inc system management homepage | <= 7.5.5.0 | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| apache tomcat | >= 6.0, <= 6.0.45 | No fix listed |
| apache tomcat | >= 7.0, <= 7.0.70 | No fix listed |
| apache tomcat | >= 8.0, <= 8.5.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- access.redhat.com
- lists.apache.org
- [tomcat-users] 20200813 Re: CVE reporting discrepencies mailing-list
- lists.apache.org
- [tomcat-users] 20200813 CVE reporting discrepencies mailing-list
- lists.apache.org
- [tomcat-users] 20200814 Re: CVE reporting discrepencies mailing-list
- lists.apache.org
- [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update mailing-list
- lists.opensuse.org
- rhn.redhat.com
- rhn.redhat.com
- rhn.redhat.com
- tomcat.apache.org release-notes vendor-advisory
- www.apache.org vendor-advisory
- www.kb.cert.org
- RHSA-2016:1635 third-party-advisory vendor-advisory
- RHSA-2016:1636 third-party-advisory vendor-advisory
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- github.com product
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- lists.apache.org
- [activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar mailing-list
- lists.apache.org
- [activemq-issues] 20190826 [jira] [Created] (AMQ-7288) Security Vulnerabilities in ActiveMQ dependent libraries. mailing-list
- github.com
- VU#797896 third-party-advisory us-government-resource
- www.oracle.com third-party-advisory
- RHSA-2016:2045 third-party-advisory vendor-advisory
- RHSA-2016:2046 third-party-advisory vendor-advisory
- 91818 third-party-advisory vdb-entry
- openSUSE-SU-2016:2252 third-party-advisory vendor-advisory
- RHSA-2016:1624 third-party-advisory vendor-advisory
- httpoxy.org third-party-advisory
- www.oracle.com patch third-party-advisory
- 1036331 third-party-advisory vdb-entry vendor-advisory
- Debian Security Tracker CVE-2016-5388 vendor-advisory