Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2016-689:01 advisory.

    Twisted is an event-based framework for internet applications.
    Twisted Web is a complete web server, aimed at hosting web applications using     Twisted and Python, but fully able to serve static pages too.
    Security issues fixed with this release:
    CVE-2016-1000111
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and
    therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY
    environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP
    traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy"
    issue. (CVE-2016-1000111)

This update for python-Twisted fixes the following issues :

  - CVE-2016-1000111: sets environmental variable HTTP_PROXY     based on user supplied Proxy request header (bsc#989997)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3585-1 advisory.

    It was discovered that Twisted incorrectly handled certain HTTP requests. An attacker could possibly use     this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat Satellite 6.2 for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 06 Feb 2018] This advisory has been updated with the correct solution. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.

Twisted is an event-based framework for internet applications. Twisted Web is a complete web server, aimed at hosting web applications using Twisted and Python, but fully able to serve static pages too.

Security Fix(es) :

* It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.
(CVE-2016-1000111)

Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.

This update fixes the following bugs :

* Upgrades from Satellite 6.2 to Satellite 6.3 were failing due to the use of certificates with custom authorities. These upgrade paths now work. (BZ# 1523880, BZ#1527963)

* Additional tooling is provided to support data validation when upgrading from Satellite 6.2 to Satellite 6.3. (BZ#1519904)

* Several memory usage bugs in goferd and qpid have been resolved.
(BZ# 1319165, BZ#1318015, BZ#1492355, BZ#1491160, BZ#1440235)

* The performance of Puppet reporting and errata applicability has been improved. (BZ#1465146, BZ#1482204)

* Upgrading from 6.2.10 to 6.2.11 without correctly stopping services can cause the upgrade to fail on removing qpid data. This case is now handled properly. (BZ#1482539)

* The cipher suites for the Puppet server can now be configured by the installation process. (BZ#1491363)

* The default cipher suite for the Apache server is now more secure by default. (BZ#1467434)

* The Pulp server contained in Satellite has been enhanced to better handle concurrent processing of errata applicability for a single host and syncing Puppet repositories. (BZ#1515195, BZ#1421594)

* VDC subscriptions create guest pools which are for a single host only. Administrators were attaching these pools to activation keys which was incorrect. The ability to do this has been disabled.
(BZ#1369189)

* Satellite was not susceptible to RHSA-2016:1978 but security scanners would incorrectly flag this as an issue. The package from this errata is now delivered in the Satellite channel to avoid these false positives. (BZ# 1497337)

* OpenScap report parsing resulted in a memory leak. This leak has been fixed. (BZ#1454743)

* The validation on the length of names for docker containers and repositories was too restrictive. Names can now be longer.
(BZ#1424689)

Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

This update for python-Twisted fixes the following issues :

  - No longer automatically export the http_proxy     environment variable to avoid the proxy being trusted by     unaware applications, if a Proxy request header is     supplied (boo#989997, CVE-2016-1000111)

It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.

An update for python-twisted-web is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Twisted is an event-based framework for internet applications. Twisted Web is a complete web server, aimed at hosting web applications using Twisted and Python, but fully able to serve static pages too.

Security Fix(es) :

* It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.
(CVE-2016-1000111)

Note: After this update, python-twisted-web will no longer pass the value of the Proxy request header to scripts via the HTTP_PROXY environment variable.

Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.

The remote Oracle Linux 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-1978 advisory.

    [8.2.0-5]
    - Rebase HTTPoxy patch and bump release for rebuild     Resolves: rhbz#1358789

    [8.2.0-4]
    - Fix HTTPoxy CVE-2016-1000111     Resolves: rhbz#1358789

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
289484	MiracleLinux 4 : python-twisted-web-8.2.0-5.AXS4 (AXSA:2016-689:01)	Nessus	Miracle Linux Local Security Checks	medium
409525	SCA: security update for twisted (GHSA-3gqj-cmxr-p4x2)	Tenable Cloud Security	SCA Checks	medium
409525	SCA: security update for twisted (GHSA-3gqj-cmxr-p4x2)	Tenable Self-Hosted Container Security	SCA Checks	medium
406709	Alpine: multiple py3-twisted packages: security update to 16.4.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406709	Alpine: multiple py3-twisted packages: security update to 16.4.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
119991	SUSE SLES12 Security Update : python-Twisted (SUSE-SU-2017:0114-1)	Nessus	SuSE Local Security Checks	medium
107146	Ubuntu 14.04 LTS / 16.04 LTS : Twisted vulnerability (USN-3585-1)	Nessus	Ubuntu Local Security Checks	medium
106615	RHEL 6 / 7 : Red Hat Satellite 6 (RHSA-2018:0273)	Nessus	Red Hat Local Security Checks	medium
95911	openSUSE Security Update : python-Twisted (openSUSE-2016-1482)	Nessus	SuSE Local Security Checks	medium
94342	Amazon Linux AMI : python-twisted-web (ALAS-2016-760)	Nessus	Amazon Linux Local Security Checks	medium
93826	RHEL 6 / 7 : python-twisted-web (RHSA-2016:1978)	Nessus	Red Hat Local Security Checks	medium
93804	Oracle Linux 6 / 7 : python-twisted-web (ELSA-2016-1978)	Nessus	Oracle Linux Local Security Checks	medium
93803	CentOS 6 / 7 : python-twisted-web (CESA-2016:1978)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2016-1000111

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium