PT-2016-4503 · Twisted+4 · Twisted+4

Kurt Seifried · Published 2016-07-18 · Updated 2024-11-25 · CVE-2016-1000111

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 16.3.1

Description The issue arises from the software's failure to address RFC 3875 section 4.1.18 namespace conflicts, which leaves CGI applications unprotected from untrusted client data in the HTTP PROXY environment variable. This could allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, also known as an "httpoxy" issue.

Recommendations For Twisted versions prior to 16.3.1, update to version 16.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP PROXY environment variable to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CESA-2016_1978

CVE-2016-1000111

GHSA-3GQJ-CMXR-P4X2

MGASA-2016-0340

OPENSUSE-SU-2024:10162-1

PYSEC-2020-214

RHSA-2016:1978

RHSA-2016_1978

RHSA-2018:0273

SUSE-SU-2017:0114-1

SUSE-SU-2017_0114-1

USN-3585-1

Affected Products

Centos

Red Hat

Suse

Twisted

Ubuntu

References · 32

• https://twistedmatrix.com/trac/ticket/8623 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1000111 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1000111 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2016-1978.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-214 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0340 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0340.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000111 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:0114-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-1000111 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10162-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3585-1 · Vendor Advisory
• https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000111 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1000111 · Vendor Advisory