Twisted: sets environmental variable based on user supplied Proxy request header
Published Mar 11, 2020
6.9
MEDIUMCVSS 4.0
EPSS 2.76%
Description
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Affected products
No data.
No data.
Red Hat Enterprise Linux 6
python-twisted-web-0:8.2.0-5.el6_8
Fixed · RHSA-2016:1978
Red Hat Enterprise Linux 7
python-twisted-web-0:12.1.0-5.el7_2
Fixed · RHSA-2016:1978
Red Hat Satellite 6.2 for RHEL 6
candlepin-0:0.9.54.26-1.el6
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
candlepin-0:0.9.54.26-1.el6
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
foreman-0:1.11.0.86-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
foreman-0:1.11.0.86-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
foreman-installer-1:1.11.0.18-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
foreman-installer-1:1.11.0.18-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
katello-0:3.0.0-33.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
katello-0:3.0.0-33.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
katello-installer-base-0:3.0.0.101-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
katello-installer-base-0:3.0.0.101-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
pulp-0:2.8.7.18-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
pulp-0:2.8.7.18-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
pulp-puppet-0:2.8.7.2-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
pulp-puppet-0:2.8.7.2-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
qpid-dispatch-0:0.4-27.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
qpid-dispatch-0:0.4-27.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
qpid-proton-0:0.9-21.el6
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
qpid-proton-0:0.9-21.el6
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
rubygem-smart_proxy_openscap-0:0.5.3.9-2.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
rubygem-smart_proxy_openscap-0:0.5.3.9-2.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
satellite-0:6.2.14-4.0.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
satellite-0:6.2.14-4.0.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
tfm-rubygem-foreman_theme_satellite-0:0.1.47.2-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
tfm-rubygem-foreman_theme_satellite-0:0.1.47.2-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
tfm-rubygem-katello-0:3.0.0.162-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 6
tfm-rubygem-katello-0:3.0.0.162-1.el6sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
candlepin-0:0.9.54.26-1.el7
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
candlepin-0:0.9.54.26-1.el7
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
foreman-0:1.11.0.86-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
foreman-0:1.11.0.86-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
foreman-installer-1:1.11.0.18-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
foreman-installer-1:1.11.0.18-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
katello-0:3.0.0-33.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
katello-0:3.0.0-33.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
katello-installer-base-0:3.0.0.101-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
katello-installer-base-0:3.0.0.101-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
pulp-0:2.8.7.18-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
pulp-0:2.8.7.18-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
pulp-puppet-0:2.8.7.2-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
pulp-puppet-0:2.8.7.2-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
python-twisted-web-0:12.1.0-5.el7_2
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
python-twisted-web-0:12.1.0-5.el7_2
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
qpid-dispatch-0:0.4-27.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
qpid-dispatch-0:0.4-27.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
qpid-proton-0:0.9-21.el7
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
qpid-proton-0:0.9-21.el7
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
rubygem-smart_proxy_openscap-0:0.5.3.9-2.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
rubygem-smart_proxy_openscap-0:0.5.3.9-2.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
satellite-0:6.2.14-4.0.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
satellite-0:6.2.14-4.0.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
tfm-rubygem-foreman_theme_satellite-0:0.1.47.2-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
tfm-rubygem-foreman_theme_satellite-0:0.1.47.2-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
tfm-rubygem-katello-0:3.0.0.162-1.el7sat
Fixed · RHSA-2018:0273
Red Hat Satellite 6.2 for RHEL 7
tfm-rubygem-katello-0:3.0.0.162-1.el7sat
Fixed · RHSA-2018:0273
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | python-twisted-web-0:8.2.0-5.el6_8 | Fixed | RHSA-2016:1978 |
| Red Hat Enterprise Linux 7 | python-twisted-web-0:12.1.0-5.el7_2 | Fixed | RHSA-2016:1978 |
| Red Hat Satellite 6.2 for RHEL 6 | candlepin-0:0.9.54.26-1.el6 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | candlepin-0:0.9.54.26-1.el6 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | foreman-0:1.11.0.86-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | foreman-0:1.11.0.86-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | foreman-installer-1:1.11.0.18-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | foreman-installer-1:1.11.0.18-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | katello-0:3.0.0-33.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | katello-0:3.0.0-33.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | katello-installer-base-0:3.0.0.101-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | katello-installer-base-0:3.0.0.101-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | pulp-0:2.8.7.18-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | pulp-0:2.8.7.18-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | pulp-puppet-0:2.8.7.2-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | pulp-puppet-0:2.8.7.2-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | qpid-dispatch-0:0.4-27.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | qpid-dispatch-0:0.4-27.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | qpid-proton-0:0.9-21.el6 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | qpid-proton-0:0.9-21.el6 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | rubygem-smart_proxy_openscap-0:0.5.3.9-2.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | rubygem-smart_proxy_openscap-0:0.5.3.9-2.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | satellite-0:6.2.14-4.0.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | satellite-0:6.2.14-4.0.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | tfm-rubygem-foreman_theme_satellite-0:0.1.47.2-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | tfm-rubygem-foreman_theme_satellite-0:0.1.47.2-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | tfm-rubygem-katello-0:3.0.0.162-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 6 | tfm-rubygem-katello-0:3.0.0.162-1.el6sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | candlepin-0:0.9.54.26-1.el7 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | candlepin-0:0.9.54.26-1.el7 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | foreman-0:1.11.0.86-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | foreman-0:1.11.0.86-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | foreman-installer-1:1.11.0.18-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | foreman-installer-1:1.11.0.18-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | katello-0:3.0.0-33.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | katello-0:3.0.0-33.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | katello-installer-base-0:3.0.0.101-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | katello-installer-base-0:3.0.0.101-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | pulp-0:2.8.7.18-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | pulp-0:2.8.7.18-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | pulp-puppet-0:2.8.7.2-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | pulp-puppet-0:2.8.7.2-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | python-twisted-web-0:12.1.0-5.el7_2 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | python-twisted-web-0:12.1.0-5.el7_2 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | qpid-dispatch-0:0.4-27.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | qpid-dispatch-0:0.4-27.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | qpid-proton-0:0.9-21.el7 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | qpid-proton-0:0.9-21.el7 | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | rubygem-smart_proxy_openscap-0:0.5.3.9-2.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | rubygem-smart_proxy_openscap-0:0.5.3.9-2.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | satellite-0:6.2.14-4.0.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | satellite-0:6.2.14-4.0.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | tfm-rubygem-foreman_theme_satellite-0:0.1.47.2-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | tfm-rubygem-foreman_theme_satellite-0:0.1.47.2-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | tfm-rubygem-katello-0:3.0.0.162-1.el7sat | Fixed | RHSA-2018:0273 |
| Red Hat Satellite 6.2 for RHEL 7 | tfm-rubygem-katello-0:3.0.0.162-1.el7sat | Fixed | RHSA-2018:0273 |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue affects the versions of python-twisted as shipped with Red Hat Satellite 6.x. However due to the manner in which python-twisted is used exploitation of this issue by an attacker would require significant access to the server, or be able to modify requests from other users via additional vulnerabilities. A future update may address this issue.
References (11)
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html x_refsource_CONFIRMThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2016-1000111 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1357345 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0227 Advisory
- https://github.com/advisories/GHSA-3gqj-cmxr-p4x2 Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-214.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000111
- https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html x_refsource_CONFIRMMailing ListVendor Advisory
- https://twistedmatrix.com/trac/ticket/8623 x_refsource_CONFIRMPatchVendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2016-1000111
- https://www.openwall.com/lists/oss-security/2016/07/18/6 x_refsource_MISCMailing ListThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html | x_refsource_CONFIRMThird Party Advisory | |
| https://access.redhat.com/security/cve/CVE-2016-1000111 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1357345 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0227 | Advisory | |
| https://github.com/advisories/GHSA-3gqj-cmxr-p4x2 | Advisory | |
| https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-214.yaml | ||
| https://nvd.nist.gov/vuln/detail/CVE-2016-1000111 | ||
| https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html | x_refsource_CONFIRMMailing ListVendor Advisory | |
| https://twistedmatrix.com/trac/ticket/8623 | x_refsource_CONFIRMPatchVendor Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2016-1000111 | ||
| https://www.openwall.com/lists/oss-security/2016/07/18/6 | x_refsource_MISCMailing ListThird Party Advisory |
Change history (0)
No recorded changes yet.