CVE-2016-6286

State: Published
Severity: Not scored
Published: Jan 10, 2017
Updated: Aug 6, 2024
Reserved: Jul 22, 2016

Description

The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP_PROXY environment variable, which would allow attackers to direct CGI programs which use this environment variable to use an attacker-specified HTTP proxy server (also known as a "httpoxy" attack). This affects all versions of spiffy-cgi-handlers before 0.5.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

[chicken-announce] 20160721 [SECURITY] spiffy-cgi-handlers and http-client updated to prevent "httpoxy" attackmailing-list
92105vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.