CVE-2016-1000107
MEDIUMErlang/OTP < 22.1 - HTTP Proxy Header Injection via HTTP_PROXY Environment Variable
Title source: manualDescription
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
References (4)
Core 4
Core References
Third Party Advisory x_refsource_misc
https://httpoxy.org/
Third Party Advisory x_refsource_misc
https://security-tracker.debian.org/tracker/CVE-2016-1000107
Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2016/07/18/6
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugs.erlang.org/browse/ERL-198
Scores
CVSS v3
6.1
EPSS
0.0143
EPSS Percentile
69.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-601
Status
published
Products (1)
erlang/erlang\/otp
< 22.1
Published
Dec 10, 2019
Tracked Since
Feb 18, 2026