CVE-2016-5388
Description
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
How to fix
- org.apache.tomcat:tomcat-catalina7.0.72, 8.5.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 6.0 ≤ v ≤ 6.0.45, 7.0 ≤ v ≤ 7.0.70, 8.0 ≤ v ≤ 8.5.4 | — |
| redhat enterprise_linux_desktop | 7.0, 6.0 | — |
| redhat enterprise_linux_hpc_node | 7.0, 6.0 | — |
| redhat enterprise_linux_hpc_node_eus | 7.2 | — |
| redhat enterprise_linux_server | 7.0, 6.0 | — |
| redhat enterprise_linux_server_aus | 7.2 | — |
| redhat enterprise_linux_server_eus | 7.2 | — |
| redhat enterprise_linux_server_tus | 7.2 | — |
| redhat enterprise_linux_workstation | 7.0, 6.0 | — |
| hp system_management_homepage | v ≤ 7.5.5.0 | — |
| oracle linux | 6, 7 | — |
| org.apache.tomcat:tomcat-catalinaMaven | 7.0.0 ≤ v < 7.0.72, 8.0.0 ≤ v < 8.5.5 | 7.0.72, 8.5.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.