High severity · published Jul 19, 2016
CVE-2016-5386
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of…
8.1
CVSS
5.2%
EPSS
No
On KEV
Description
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.2 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
7.2 · source: NVD
FE
Fedora · Fedoraproject
23; 24 · source: NVD
GO
GO · Golang
1.0 before 1.6.3; 1.7 · source: NVD
LI
Linux · Oracle
7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5386
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1538.html
Third Party Advisory
http://www.kb.cert.org/vuls/id/797896
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1353798
Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)