SUSE-SU-2016:1820-1

It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-1000104). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated Apache server ignores such HTTP headers and never sets $HTTPPROXY for sub-processes (unless a value has been explicitly configured by the administrator in the configuration file). (bsc#988492)

References

Affected packages

Name: apache2-mod_fcgid
Purl: pkg:rpm/suse/apache2-mod_fcgid&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2-31.29.1

{
    "binaries": [
        {
            "apache2-mod_fcgid": "2.2-31.29.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:1820-1.json"