Vulnerability Description
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fedoraproject | Fedora | 23 |
| Oracle | Linux | 7 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Server Aus | 7.2 |
| Redhat | Enterprise Linux Server Eus | 7.2 |
| Golang | Go | >= 1.0, < 1.6.3 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2016-1538.htmlThird Party Advisory
- http://www.kb.cert.org/vuls/id/797896Third Party AdvisoryUS Government Resource
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatchThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.hThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1353798Issue TrackingThird Party Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_naThird Party Advisory
- https://httpoxy.org/Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- http://rhn.redhat.com/errata/RHSA-2016-1538.htmlThird Party Advisory
- http://www.kb.cert.org/vuls/id/797896Third Party AdvisoryUS Government Resource
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatchThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.hThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1353798Issue TrackingThird Party Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_naThird Party Advisory
FAQ
What is CVE-2016-5386?
CVE-2016-5386 is a vulnerability with a CVSS score of 8.1 (HIGH). The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client dat...
How severe is CVE-2016-5386?
CVE-2016-5386 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-5386?
Check the references section above for vendor advisories and patch information. Affected products include: Fedoraproject Fedora, Oracle Linux, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus.