Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNncWotY214ci1wNHgy
Forced Browsing in Twisted
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY
environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an httpoxy
issue.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNncWotY214ci1wNHgy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: 8 months ago
CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Identifiers: GHSA-3gqj-cmxr-p4x2, CVE-2016-1000111
References:
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000111
- https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html
- https://twistedmatrix.com/trac/ticket/8623
- https://www.openwall.com/lists/oss-security/2016/07/18/6
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- https://github.com/advisories/GHSA-3gqj-cmxr-p4x2
Affected Packages
pypi:twisted
Dependent packages: 135Dependent repositories: 8,515
Downloads: 4,513,089 last month
Affected Version Ranges: < 16.3.1
Fixed in: 16.3.1
All affected versions: 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.0, 1.1.1, 1.2.0, 2.1.0, 2.4.0, 2.5.0, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 9.0.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, 12.1.0, 12.2.0, 12.3.0, 13.0.0, 13.1.0, 13.2.0, 14.0.0, 14.0.1, 14.0.2, 15.0.0, 15.1.0, 15.2.0, 15.2.1, 15.3.0, 15.4.0, 15.5.0, 16.0.0, 16.1.0, 16.1.1, 16.2.0, 16.3.0
All unaffected versions: 16.3.1, 16.3.2, 16.4.0, 16.4.1, 16.5.0, 16.6.0, 17.1.0, 17.5.0, 17.9.0, 18.4.0, 18.7.0, 18.9.0, 19.2.0, 19.2.1, 19.7.0, 19.10.0, 20.3.0, 21.2.0, 21.7.0, 22.1.0, 22.2.0, 22.4.0, 22.8.0, 22.10.0, 23.8.0, 23.10.0, 24.3.0