VulnerableCode Package Details - pkg:rpm/redhat/jbcs-httpd24-openssl@1:1.0.2h-4.jbcs?arch=el6

Search for packages

Vulnerability	Summary	Fixed by
VCID-2xc4-7zg9-y7fw Aliases: CVE-2016-5387	HTTP_PROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to avoid colliding with this CGI namespace. A mitigation is provided for the httpd CGI environment to avoid populating the "HTTP_PROXY" variable from a "Proxy:" header, which has never been registered by IANA. This workaround and patch are documented in the ASF Advisory at asf-httpoxy-response.txt and incorporated in the 2.4.25 and 2.2.32 releases. Note: This is not assigned an httpd severity, as it is a defect in other software which overloaded well-established CGI environment variables, and does not reflect an error in HTTP server software.	There are no reported fixed by versions.
VCID-33f9-ps96-9bfz Aliases: CVE-2016-2106	Multiple vulnerabilities have been found in OpenSSL, the worst of which allows attackers to conduct a time based side-channel attack.	There are no reported fixed by versions.
VCID-k4kb-21tp-4kc8 Aliases: CVE-2015-3183	An HTTP request smuggling attack was possible due to a bug in parsing of chunked requests. A malicious client could force the server to misinterpret the request length, allowing cache poisoning or credential hijacking if an intermediary proxy is in use.	There are no reported fixed by versions.
VCID-snj8-2smt-3kdv Aliases: CVE-2016-3110 GHSA-68qq-3phh-53j7	mod_cluster Denial of Service vulnerability mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.	There are no reported fixed by versions.
VCID-vqe4-4q4r-aybe Aliases: CVE-2016-2105	Multiple vulnerabilities have been found in OpenSSL, the worst of which allows attackers to conduct a time based side-channel attack.	There are no reported fixed by versions.
VCID-y2dr-h2d9-xbaa Aliases: CVE-2016-4459	mod_cluster: Buffer overflow in mod_manager when sending request with long JVMRoute	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-2xc4-7zg9-y7fw
Aliases:
CVE-2016-5387

HTTP_PROXY is a well-defined environment variable in a CGI process, which collided with a number of libraries which failed to avoid colliding with this CGI namespace. A mitigation is provided for the httpd CGI environment to avoid populating the "HTTP_PROXY" variable from a "Proxy:" header, which has never been registered by IANA. This workaround and patch are documented in the ASF Advisory at asf-httpoxy-response.txt and incorporated in the 2.4.25 and 2.2.32 releases. Note: This is not assigned an httpd severity, as it is a defect in other software which overloaded well-established CGI environment variables, and does not reflect an error in HTTP server software.