NVD Vulnerability Detail

CVE-2016-1000108

Summary	yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Publication Date	Dec. 11, 2019, 12:15 a.m.
Registration Date	Jan. 26, 2021, 2:04 p.m.
Last Update	Nov. 21, 2024, 11:42 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:yaws:yaws::::::::					2.0.4

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2016/07/18/6	Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2016/07/18/6	Mailing List Third Party Advisory
3	https://github.com/klacke/yaws/commit/9d8fb070e782c95821c90d0ca7372fc6d7316c78#diff-54053c47eb173a90c26ed19bd9d106c1	Patch Third Party Advisory
4	https://github.com/klacke/yaws/commit/9d8fb070e782c95821c90d0ca7372fc6d7316c78#diff-54053c47eb173a90c26ed19bd9d106c1	Patch Third Party Advisory
5	https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000108.json	Third Party Advisory
6	https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000108.json	Third Party Advisory
7	https://security-tracker.debian.org/tracker/CVE-2016-1000108	Third Party Advisory
8	https://security-tracker.debian.org/tracker/CVE-2016-1000108	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-601	オープンリダイレクト	https://cwe.mitre.org/data/definitions/601.html

JVN Vulnerability Information

yaws におけるオープンリダイレクトの脆弱性

Title	yaws におけるオープンリダイレクトの脆弱性
Summary	yaws には、オープンリダイレクトの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 25, 2016, midnight
Registration Date	Dec. 19, 2019, 10:51 a.m.
Last Update	Dec. 19, 2019, 10:51 a.m.

Affected System

Debian

Debian GNU/Linux

Yaws

Yaws 2.0.4 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-1000108	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000108
Debian Security Tracker
2	CVE-2016-1000108	https://security-tracker.debian.org/tracker/CVE-2016-1000108
National Vulnerability Database (NVD)
3	CVE-2016-1000108	https://nvd.nist.gov/vuln/detail/CVE-2016-1000108

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-601	https://cwe.mitre.org/data/definitions/601.html

ベンダー情報

No	Name	URL
GitHub
1	Security flaw http://httpoxy.org/ fixed	https://github.com/klacke/yaws/commit/9d8fb070e782c95821c90d0ca7372fc6d7316c78#diff-54053c47eb173a90c26ed19bd9d106c1

Change Log

No	Changed Details	Date of change
1	[2019年12月19日] 掲載	Dec. 19, 2019, 10:51 a.m.