CVE-2016-1000108

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-1000108
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1000108.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-1000108
Related
Published
2019-12-10T15:15:11Z
Modified
2025-07-01T23:04:58.957843Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

References

Affected packages

Debian:11 / yaws

Package

Name
yaws
Purl
pkg:deb/debian/yaws?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.3-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / yaws

Package

Name
yaws
Purl
pkg:deb/debian/yaws?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.3-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / yaws

Package

Name
yaws
Purl
pkg:deb/debian/yaws?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.3-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/erlyaws/yaws

Affected ranges

Type
GIT
Repo
https://github.com/erlyaws/yaws
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9d8fb070e782c95821c90d0ca7372fc6d7316c78

Affected versions

yaws-1.*

yaws-1.81
yaws-1.82
yaws-1.83
yaws-1.84
yaws-1.85
yaws-1.86
yaws-1.87
yaws-1.88
yaws-1.89
yaws-1.90
yaws-1.91
yaws-1.92
yaws-1.93
yaws-1.94
yaws-1.95
yaws-1.96
yaws-1.97
yaws-1.98
yaws-1.99

yaws-2.*

yaws-2.0
yaws-2.0.2
yaws-2.0.3

Other

yaws-erlang-18