PSF-2019-2

vendorUSosv

HTTPoxy attack

view advisory published 2019-11-27Licence: per source

The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2016-1000110US	medium6.1	4.53% (91st)	—	2019-11-27
The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP reque…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/cve-2016-1000110ADVISORY
https://bugs.python.org/issue27568REPORT
https://httpoxy.org/WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan