CVE-2016-5387
Fixed in a distro release EPSS 56%
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
Products: apache http_server, hp system_management_homepage, oracle communications_user_data_repository, oracle enterprise_manager_ops_center, oracle linux, oracle solaris, fedoraproject fedora, redhat jboss_web_server, redhat jboss_enterprise_web_server, redhat jboss_core_services, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation, debian_linux, canonical ubuntu_linux, opensuse leap, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.4 | apache2 | 2.4.23-r1 |
| Debian 12 | apache2 | 2.4.23-2 |
| Debian 13 | apache2 | 2.4.23-2 |
| Debian 14 | apache2 | 2.4.23-2 |
| Debian 7 | apache2 | 2.2.22-13+deb7u7 |
| Debian 8 | apache2 | 2.4.10-10+deb8u5 |
| Red Hat Enterprise Linux 5 | httpd | 0:2.2.3-92.el5_11 |
| Red Hat Enterprise Linux 5 | httpd-debuginfo | 0:2.2.3-92.el5_11 |
| Red Hat Enterprise Linux 5 | httpd-devel | 0:2.2.3-92.el5_11 |
| Red Hat Enterprise Linux 5 | httpd-manual | 0:2.2.3-92.el5_11 |
| Red Hat Enterprise Linux 5 | mod_ssl | 1:2.2.3-92.el5_11 |
| Red Hat Enterprise Linux 6 | httpd | 0:2.2.15-54.el6_8 |
| Red Hat Enterprise Linux 6 | httpd-debuginfo | 0:2.2.15-54.el6_8 |
| Red Hat Enterprise Linux 6 | httpd-devel | 0:2.2.15-54.el6_8 |
| Red Hat Enterprise Linux 6 | httpd-manual | 0:2.2.15-54.el6_8 |
| Red Hat Enterprise Linux 6 | httpd-tools | 0:2.2.15-54.el6_8 |
| Red Hat Enterprise Linux 6 | mod_ssl | 1:2.2.15-54.el6_8 |
| Red Hat Enterprise Linux 7 | httpd | 0:2.4.6-40.el7_2.4 |
| Red Hat Enterprise Linux 7 | httpd-debuginfo | 0:2.4.6-40.el7_2.4 |
| Red Hat Enterprise Linux 7 | httpd-devel | 0:2.4.6-40.el7_2.4 |
| Red Hat Enterprise Linux 7 | httpd-manual | 0:2.4.6-40.el7_2.4 |
| Red Hat Enterprise Linux 7 | httpd-tools | 0:2.4.6-40.el7_2.4 |
| Red Hat Enterprise Linux 7 | mod_ldap | 0:2.4.6-40.el7_2.4 |
| Red Hat Enterprise Linux 7 | mod_proxy_html | 1:2.4.6-40.el7_2.4 |
| Red Hat Enterprise Linux 7 | mod_session | 0:2.4.6-40.el7_2.4 |
| Red Hat Enterprise Linux 7 | mod_ssl | 1:2.4.6-40.el7_2.4 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-src-zip | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-src-zip | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-zip | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-zip | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.6-77.SP1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.6-77.SP1.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.26-54.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-debuginfo | 0:2.2.26-54.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.26-54.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.26-54.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.26-54.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd22 | 0:2.2.26-56.ep6.el7 |
| Red Hat jboss enterprise web server 2 | httpd22-debuginfo | 0:2.2.26-56.ep6.el7 |
| Red Hat jboss enterprise web server 2 | httpd22-devel | 0:2.2.26-56.ep6.el7 |
| Red Hat jboss enterprise web server 2 | httpd22-manual | 0:2.2.26-56.ep6.el7 |
| Red Hat jboss enterprise web server 2 | httpd22-tools | 0:2.2.26-56.ep6.el7 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24 | 0:1-3.jbcs.el7 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24 | 0:1-3.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl | 1:1.0.2h-4.jbcs.el7 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl | 1:1.0.2h-4.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2h-4.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2h-4.jbcs.el7 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-devel | 1:1.0.2h-4.jbcs.el7 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-devel | 1:1.0.2h-4.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-libs | 1:1.0.2h-4.jbcs.el7 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-libs | 1:1.0.2h-4.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-perl | 1:1.0.2h-4.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-perl | 1:1.0.2h-4.jbcs.el7 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-static | 1:1.0.2h-4.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-openssl-static | 1:1.0.2h-4.jbcs.el7 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-runtime | 0:1-3.jbcs.el6 |
| Red Hat jboss enterprise web server 2 | jbcs-httpd24-runtime | 0:1-3.jbcs.el7 |
| Red Hat jboss enterprise web server 2 | mod_cluster | 0:1.2.13-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster | 0:1.2.13-1.Final_redhat_1.1.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native | 0:1.2.13-3.Final_redhat_2.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native | 0:1.2.13-3.Final_redhat_2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native-debuginfo | 0:1.2.13-3.Final_redhat_2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native-debuginfo | 0:1.2.13-3.Final_redhat_2.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_cluster-tomcat6 | 0:1.2.13-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-tomcat6 | 0:1.2.13-1.Final_redhat_1.1.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_cluster-tomcat7 | 0:1.2.13-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-tomcat7 | 0:1.2.13-1.Final_redhat_1.1.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_jk | 0:1.2.41-2.redhat_3.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_jk | 0:1.2.41-2.redhat_3.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_jk-ap22 | 0:1.2.41-2.redhat_3.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_jk-ap22 | 0:1.2.41-2.redhat_3.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_jk-debuginfo | 0:1.2.41-2.redhat_3.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_jk-debuginfo | 0:1.2.41-2.redhat_3.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_jk-manual | 0:1.2.41-2.redhat_3.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_jk-manual | 0:1.2.41-2.redhat_3.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.26-54.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_ssl22 | 1:2.2.26-56.ep6.el7 |
| Red Hat jboss enterprise web server 2 | tomcat-native | 0:1.1.34-5.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat-native | 0:1.1.34-5.redhat_1.ep6.el7 |
| Red Hat jboss enterprise web server 2 | tomcat-native-debuginfo | 0:1.1.34-5.redhat_1.ep6.el7 |
| Red Hat jboss enterprise web server 2 | tomcat-native-debuginfo | 0:1.1.34-5.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24 | 0:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24 | 0:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-debuginfo | 0:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-debuginfo | 0:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-devel | 0:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-devel | 0:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-manual | 0:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-manual | 0:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-tools | 0:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-tools | 0:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_ldap24 | 0:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_ldap24 | 0:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_proxy24_html | 1:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_proxy24_html | 1:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_session24 | 0:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_session24 | 0:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_ssl24 | 1:2.4.6-62.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_ssl24 | 1:2.4.6-62.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7 | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7 | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-admin-webapps | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-admin-webapps | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-docs-webapp | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-docs-webapp | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-el-2.2-api | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-el-2.2-api | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-javadoc | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-javadoc | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-jsp-2.2-api | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-jsp-2.2-api | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-lib | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-lib | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-log4j | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-log4j | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-servlet-3.0-api | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-servlet-3.0-api | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-webapps | 0:7.0.59-51_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-webapps | 0:7.0.59-51_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8 | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8 | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-admin-webapps | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-admin-webapps | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-docs-webapp | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-docs-webapp | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-el-2.2-api | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-el-2.2-api | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-javadoc | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-javadoc | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-jsp-2.3-api | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-jsp-2.3-api | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-lib | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-lib | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-log4j | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-log4j | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-servlet-3.1-api | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-servlet-3.1-api | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-webapps | 0:8.0.18-62_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-webapps | 0:8.0.18-62_patch_01.ep7.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd | 0:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd | 0:2.4.18-11.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-debuginfo | 0:2.4.18-11.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-debuginfo | 0:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-devel | 0:2.4.18-11.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-devel | 0:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-manual | 0:2.4.18-11.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-manual | 0:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-tools | 0:2.4.18-11.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-tools | 0:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_ldap | 0:2.4.18-11.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_ldap | 0:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_proxy_html | 1:2.4.18-11.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_proxy_html | 1:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_session | 0:2.4.18-11.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_session | 0:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_ssl | 1:2.4.18-11.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_ssl | 1:2.4.18-11.el6 |
| SUSE Linux Enterprise Server 11 SP4 | apache2 | 2.2.12-64.1 |
| SUSE Linux Enterprise Server 12 SP1 | apache2 | 2.4.16-7.1 |
| SUSE Linux Enterprise Server 12-LTSS | apache2 | 2.4.10-14.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | apache2 | 2.2.12-64.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | apache2 | 2.4.10-14.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | apache2 | 2.4.16-7.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | apache2 | 2.2.12-64.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | apache2 | 2.4.16-7.1 |
| SUSE Studio Onsite 1.3 | apache2 | 2.2.12-64.1 |
| Ubuntu 14.04 LTS | apache2 | 2.4.7-1ubuntu4.13 |
| Ubuntu 16.04 LTS | apache2 | 2.4.18-2ubuntu3.1 |
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 |