MGASA-2016-0340

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2016-0340.html
Import Source
https://advisories.mageia.org/MGASA-2016-0340.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2016-0340
Related
Published
2016-10-12T13:46:10Z
Modified
2016-10-12T13:38:32Z
Summary
Updated python-twisted-web packages fix a security vulnerability
Details

It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-1000111)

References
Credits

Affected packages

Mageia:5 / python-twisted-web

Package

Name
python-twisted-web
Purl
pkg:rpm/mageia/python-twisted-web?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
14.0.1-3.1.mga5

Ecosystem specific 

{
    "section": "core"
}