Medium severity · published Mar 11, 2020
CVE-2016-1000111
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client…
5.3
CVSS
2.8%
EPSS
No
On KEV
Description
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twisted · Twisted
before 16.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-1000111
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-1000111
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
Mailing List
https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html
Patch
https://twistedmatrix.com/trac/ticket/8623
Mailing List
https://www.openwall.com/lists/oss-security/2016/07/18/6
More from Twisted
9.8
CVE-2020-10109
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
9.8
CVE-2020-10108
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
8.7
CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
8.1
CVE-2022-24801
Twisted is an event-based framework for internet applications, supporting Python 3.6+
7.5
CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer