Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1353794

http://www.kb.cert.org/vuls/id/797896

https://httpoxy.org/

https://lists.fedoraproject.org/archives/list/[email protected]/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/

https://lists.fedoraproject.org/archives/list/[email protected]/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/

https://lists.fedoraproject.org/archives/list/[email protected]/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297

http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html

http://www.securityfocus.com/bid/91821

http://rhn.redhat.com/errata/RHSA-2016-1611.html

http://rhn.redhat.com/errata/RHSA-2016-1612.html

http://rhn.redhat.com/errata/RHSA-2016-1613.html

http://rhn.redhat.com/errata/RHSA-2016-1610.html

http://rhn.redhat.com/errata/RHSA-2016-1609.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

https://www.drupal.org/SA-CORE-2016-003

https://github.com/guzzle/guzzle/releases/tag/6.2.1

https://security.gentoo.org/glsa/201611-22

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us

http://www.securitytracker.com/id/1036335

http://www.debian.org/security/2016/dsa-3631

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Details

Risk Information

CVSS v2

CVSS v3