Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted cli…
高危 CVSS 8.1
摘要
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future relea…
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
- :
- :
- :
- :
数据来源
- NVD DATABASE
原始链接
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1624.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2045.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2046.html Third Party Advisory
- http://www.kb.cert.org/vuls/id/797896 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html Third Party Advisory
- http://www.securityfocus.com/bid/91818 Third Party Advisory
- http://www.securitytracker.com/id/1036331 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1635 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1636 Third Party Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us Third Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 Third Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759 Third Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 Third Party Advisory
- https://httpoxy.org/ Third Party Advisory
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
- https://tomcat.apache.org/tomcat-7.0-doc/changelog.html Release Notes
- https://www.apache.org/security/asf-httpoxy-response.txt Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1624.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2045.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2046.html Third Party Advisory
- http://www.kb.cert.org/vuls/id/797896 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html Third Party Advisory
- http://www.securityfocus.com/bid/91818 Third Party Advisory
- http://www.securitytracker.com/id/1036331 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1635 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1636 Third Party Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us Third Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 Third Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759 Third Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 Third Party Advisory
- https://httpoxy.org/ Third Party Advisory
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
- https://tomcat.apache.org/tomcat-7.0-doc/changelog.html Release Notes
- https://www.apache.org/security/asf-httpoxy-response.txt Vendor Advisory
时间线
- nvd_ingest NVD