CVE-2016-5388
published 2016-07-19CVE-2016-5388: Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect…
PriorityP261high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EPSS
50.90%
98.8th percentile
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | 6.0 – 6.0.45 | — |
| apache | tomcat | 7.0 – 7.0.70 | — |
| apache | tomcat | 8.0 – 8.5.4 | — |
| debian | tomcat9 | — | — |
| hp | system_management_homepage | <= 7.5.5.0 | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_hpc_node_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attack is only possible when the CGI Servlet is enabled in Tomcat; scope detection to CGI-enabled deployments of Tomcat 7.x through 7.0.70 and 8.x through 8.5.4. ↗
- →Monitor CGI script processes for unexpected HTTP_PROXY environment variable values set from inbound request headers, which may indicate traffic is being redirected to an attacker-controlled proxy. ↗
- ·The vulnerability only applies when the CGI Servlet is explicitly enabled in Tomcat; default installations without CGI Servlet enabled are not affected. ↗
- ·The root cause is RFC 3875 section 4.1.18 compliance — CGI implementations that map HTTP headers to environment variables (HTTP_PROXY from Proxy header) are inherently susceptible unless the Proxy header is explicitly blocked or sanitized. ↗
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
ghsa8.1HIGH
osv8.1HIGH
vendor_debian8.1LOW
vendor_redhat8.1HIGH
vendor_ubuntu8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Access Control in Apache Tomcat
osv·2022-05-13·CVSS 8.1
CVE-2016-5388 [HIGH] Improper Access Control in Apache Tomcat
Improper Access Control in Apache Tomcat
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
GHSA
Improper Access Control in Apache Tomcat
ghsa·2022-05-13·CVSS 8.1
CVE-2016-5388 [HIGH] CWE-284 Improper Access Control in Apache Tomcat
Improper Access Control in Apache Tomcat
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
OSV
tomcat7 vulnerabilities
osv·2021-03-15·CVSS 8.1
CVE-2016-5388 [HIGH] tomcat7 vulnerabilities
tomcat7 vulnerabilities
It was discovered that Apache Tomcat 7 did not protect applications from the
presence of untrusted client data in an environment variable. A remote
attacker could possible use this vulnerability to redirect the traffic to an
arbitrary proxy and obtain sensitive information. (CVE-2016-5388)
It was discovered that Apache Tomcat 7 mishandled specially crafted input.
An attacker could use this vulnerability to cause a denial of service.
(CVE-2018-1336)
OSV
tomcat6, tomcat7 regression
osv·2017-02-02·CVSS 5.9
[MEDIUM] tomcat6, tomcat7 regression
tomcat6, tomcat7 regression
USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a
regression in environments where Tomcat is started with a security manager.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. This issue only applied to Ubuntu
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. This issue only
applied to Ubuntu 12.04 LT
OSV
tomcat6, tomcat7, tomcat8 vulnerabilities
osv·2017-01-23·CVSS 5.9
CVE-2016-0762 [MEDIUM] tomcat6, tomcat7, tomcat8 vulnerabilities
tomcat6, tomcat7, tomcat8 vulnerabilities
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. This issue only applied to Ubuntu
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. This issue only
applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-5018)
It was discovered that Tomcat did not protect applications from untrusted
data in the HTTP_PROXY environment variable. A remote attacker could
possibly use this issue t
OSV
CVE-2016-5388: Apache Tomcat 7
osv·2016-07-18·CVSS 8.1
CVE-2016-5388 [HIGH] CVE-2016-5388: Apache Tomcat 7
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Ubuntu
Apache Tomcat 7 vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 8.1
CVE-2016-5388 [HIGH] Apache Tomcat 7 vulnerabilities
Title: Apache Tomcat 7 vulnerabilities
Summary: Several security issues were fixed in Apache Tomcat 7.
It was discovered that Apache Tomcat 7 did not protect applications from the
presence of untrusted client data in an environment variable. A remote
attacker could possible use this vulnerability to redirect the traffic to an
arbitrary proxy and obtain sensitive information. (CVE-2016-5388)
It was discovered that Apache Tomcat 7 mishandled specially crafted input.
An attacker could use this vulnerability to cause a denial of service.
(CVE-2018-1336)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Tomcat regression
vendor_ubuntu·2017-02-02·CVSS 5.9
[MEDIUM] Tomcat regression
Title: Tomcat regression
Summary: USN-3177-1 introduced a regression in Tomcat.
USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a
regression in environments where Tomcat is started with a security manager.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. This issue only applied to Ubuntu
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager res
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2017-01-23·CVSS 5.9
CVE-2016-0762 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that the Tomcat realm implementations incorrectly handled
passwords when a username didn't exist. A remote attacker could possibly
use this issue to enumerate usernames. This issue only applied to Ubuntu
12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-0762)
Alvaro Munoz and Alexander Mirosh discovered that Tomcat incorrectly
limited use of a certain utility method. A malicious application could
possibly use this to bypass Security Manager restrictions. This issue only
applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-5018)
It was discovered that Tomcat did not protect applications from untrusted
data in the HTTP_PROXY environment variable. A rem
Red Hat
Tomcat: CGI sets environmental variable based on user supplied Proxy request header
vendor_redhat·2016-07-18·CVSS 8.1
CVE-2016-5388 [HIGH] CWE-20 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
Tomcat: CGI sets environmental variable based on user supplied Proxy request header
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY en
Debian
CVE-2016-5388: tomcat9 - Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is ...
vendor_debian·2016·CVSS 8.1
CVE-2016-5388 [HIGH] CVE-2016-5388: tomcat9 - Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is ...
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-8647 Ansible: in some circumstances the mysql_user module may fail to correctly change a password
bugzilla·2016-11-17·CVSS 4.9
CVE-2016-8647 [MEDIUM] CVE-2016-8647 Ansible: in some circumstances the mysql_user module may fail to correctly change a password
CVE-2016-8647 Ansible: in some circumstances the mysql_user module may fail to correctly change a password
It is reported that in Ansible, under some circumstances the mysql_user module may fail to correctly change a password. Thus an old password may still be active when it should have been changed.
External References:
https://github.com/ansible/ansible-modules-core/pull/5388
Discussion:
Created ansible tracking bugs for this issue:
Affects: fedora-all [bug 1396175]
---
Created ansible tracking bugs for this issue:
Affects: epel-all [bug 1396176]
---
This was actually fixed in ansible-2.2.1.0 which was pushed a while back. ;(
---
(In reply to Kevin Fenzi from comment #4)
> This was actually fixed in ansible-2.2.1.0 which was pushed a while back. ;(
Please, don't close the bu
Bugzilla
CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header [fedora-all]
bugzilla·2016-09-13·CVSS 8.1
CVE-2016-5388 [HIGH] CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header [fedora-all]
CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affect
Bugzilla
CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header [epel-all]
bugzilla·2016-09-13·CVSS 8.1
CVE-2016-5388 [HIGH] CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header [epel-all]
CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue aff
Bugzilla
CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
bugzilla·2016-07-08·CVSS 8.1
CVE-2016-5388 [HIGH] CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
Dominic Scheirlinck of VendHQ reports:
Many software projects and vendors have implemented support for the “Proxy” request header in their respective CGI implementations and languages by creating the “HTTP_PROXY” environmental variable based on the header value. When this variable is used (in many cases automatically by various HTTP client libraries) any outgoing requests generated in turn from the attackers original request can be redirected to an attacker controlled proxy. This allows attackers to view potentially sensitive information, reply with malformed data, or to hold connections open causing a potential denial of service.
The Tomcat server contains support for CGI. If passed a “Pro
http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1624.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2045.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2046.htmlhttp://www.kb.cert.org/vuls/id/797896http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.securityfocus.com/bid/91818http://www.securitytracker.com/id/1036331https://access.redhat.com/errata/RHSA-2016:1635https://access.redhat.com/errata/RHSA-2016:1636https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_ushttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722https://httpoxy.org/https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/08/msg00015.htmlhttps://tomcat.apache.org/tomcat-7.0-doc/changelog.htmlhttps://www.apache.org/security/asf-httpoxy-response.txthttp://lists.opensuse.org/opensuse-updates/2016-09/msg00025.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1624.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2045.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2046.htmlhttp://www.kb.cert.org/vuls/id/797896http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.securityfocus.com/bid/91818http://www.securitytracker.com/id/1036331https://access.redhat.com/errata/RHSA-2016:1635https://access.redhat.com/errata/RHSA-2016:1636https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_ushttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722https://httpoxy.org/https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/08/msg00015.htmlhttps://tomcat.apache.org/tomcat-7.0-doc/changelog.htmlhttps://www.apache.org/security/asf-httpoxy-response.txt
2016-07-19
Published