MGASA-2016-0312

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2016-5388
Published: 21 Sept 2016, 20:38
Last modified:16 Apr 2026, 06:25

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Sept 2016, 20:38
Published
Vulnerability first disclosed
16 Apr 2026, 06:25
Last Modified
Vulnerability information updated

Description

Updated tomcat packages fix security vulnerability Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue (CVE-2016-5388).

Affected Systems

  • mageia•tomcat

    < 7.0.68-1.3.mga5

References (3)