CVE-2016-5386 — Improper Access Control in Redhat Enterprise Linux Server
Severity
8.1HIGHNVD
EPSS
45.9%
top 2.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 19
Latest updateAug 9
Description
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9
Affected Packages3 packages
Also affects: Fedora 23, 24, Enterprise Linux 7.2
Patches
🔴Vulnerability Details
4📋Vendor Advisories
2Microsoft▶
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client dat↗2016-07-12
💬Community
3Bugzilla▶
CVE-2016-5386 golang: Go: sets environmental variable based on user supplied Proxy request header [fedora-all]↗2016-07-18
Bugzilla▶
CVE-2016-5386 golang: Go: sets environmental variable based on user supplied Proxy request header [epel-6]↗2016-07-18
Bugzilla▶
CVE-2016-5386 Go: sets environmental variable based on user supplied Proxy request header↗2016-07-08