CVE-2016-1000110 — Open Redirect in Python

CWE-601 — Open RedirectCWE-20 — Improper Input Validation13 documents8 sources
Severity
6.1MEDIUMNVD
OSV6.5
EPSS
5.9%
top 9.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
PythonDebian Python2.7Debian Linux+1 more
Timeline
PublishedNov 27
Latest updateMay 24

Description

The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDpython/python2.7.0 — 2.7.13+3
▶debiandebian/python2.7< python2.7 2.7.12-2 (bullseye)

Also affects: Debian Linux 10.0, 8.0, 9.0, Fedora 23

🔴Vulnerability Details

4
GHSA
GHSA-97ww-5p4j-7pg9: The CGIHandler class in Python before 2↗2022-05-24
▶
OSV
CVE-2016-1000110: The CGIHandler class in Python before 2↗2019-11-27
▶
OSV
python2.7, python3.2, python3.4, python3.5 vulnerabilities↗2016-11-22
▶
VulnCheck
python python URL Redirection to Untrusted Site ('Open Redirect')↗2016
▶

📋Vendor Advisories

3
Ubuntu
Python vulnerabilities↗2016-11-22
▶
Red Hat
CGIHandler: sets environmental variable based on user supplied Proxy request header↗2016-07-18
▶
Debian
CVE-2016-1000110: python2.7 - The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_P...↗2016
▶

💬Community

5
Bugzilla
CVE-2016-1000110 python3: Python CGIHandler: sets environmental variable based on user supplied Proxy request header [fedora-all]↗2016-07-22
▶
Bugzilla
CVE-2016-1000110 python: Python CGIHandler: sets environmental variable based on user supplied Proxy request header [fedora-all]↗2016-07-22
▶
Bugzilla
CVE-2016-1000110 python34: Python CGIHandler: sets environmental variable based on user supplied Proxy request header [epel-7]↗2016-07-22
▶
Bugzilla
CVE-2016-1000110 python26: Python CGIHandler: sets environmental variable based on user supplied Proxy request header [epel-5]↗2016-07-22
▶
Bugzilla
CVE-2016-1000110 Python CGIHandler: sets environmental variable based on user supplied Proxy request header↗2016-07-18
▶