PT-2019-7507 · Erlang+2 · Erlang+2

Kurt Seifried · Published 2019-12-10 · Updated 2025-11-06 · CVE-2016-1000107

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Erlang versions prior to 22.1

Description The issue allows remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request. This is related to the handling of the HTTP PROXY environment variable, where untrusted client data is not properly protected, following RFC 3875 section 4.1.18.

Recommendations For versions prior to 22.1, consider restricting access to the HTTP PROXY environment variable to minimize the risk of exploitation. As a temporary workaround, avoid using the HTTP PROXY variable in the affected applications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2021-3065

ALT-PU-2021-3284

ALT-PU-2024-9499

CVE-2016-1000107

OPENSUSE-SU-2025:15706-1

Affected Products

Alt Linux

Debian

Erlang

References · 12

• https://osv.dev/vulnerability/openSUSE-SU-2025:15706-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000107 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1000107 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000107 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-1000107 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1000107 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-1000107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1000107 · Vendor Advisory
• https://bugs.erlang.org/browse/ERL-198 · Vendor Advisory
• https://httpoxy.org · Note
• http://openwall.com/lists/oss-security/2016/07/18/6 · Note
• https://suse.com/security/cve/CVE-2016-1000107 · Note