CVE-2016-6287 | BDVDB-2026-80121 Detail

Description#

The "http-client" egg always used a HTTP_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even when running as a CGI process. Under several web servers this would mean a user-supplied "Proxy" header could allow an attacker to direct all HTTP requests through a proxy (also known as a "httpoxy" attack). This affects all versions of http-client before 0.10.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12017-01-10Record published in the CVE List.
2. Version 22024-08-06Most recent update recorded in the CVE List.