VulnerabilityModified

CVE-2016-5387

HIGH 8.1EPSS 55.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 55.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 55.72% probability · 99th percentile
CISA KEV: Not listed
Affected: apache/http server · hp/system management homepage · oracle/communications user data repository · oracle/enterprise manager ops center · oracle/linux · oracle/solaris · fedoraproject/fedora · redhat/jboss web server · redhat/jboss enterprise web server · redhat/jboss core services · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server tus · redhat/enterprise linux workstation · debian/debian linux · canonical/ubuntu linux · opensuse/leap · opensuse/opensuse
Source: secalert@redhat.com

References

http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1624.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1625.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1648.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1649.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1650.htmlBroken Link, Third Party Advisory
http://www.debian.org/security/2016/dsa-3623Third Party Advisory
http://www.kb.cert.org/vuls/id/797896Third Party Advisory, US Government Resource
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlThird Party Advisory
http://www.securityfocus.com/bid/91816Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036330Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3038-1Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1420Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1421Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1422Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1635Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1636Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1851Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_usThird Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722Third Party Advisory
https://httpoxy.org/Third Party Advisory
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.