Vulnerability advisory

GHSA-m6ch-gg5f-wxx3

HTTP Proxy header vulnerability

Published Apr 7, 2022Updated Nov 8, 2023OSV record ↗

Also known as CVE-2016-5385

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

guzzlehttp/guzzle Packagist

All guzzlehttp/guzzle advisories →

Affected	Fixed in
`6` to before 6.2.1	`6.2.1`Advisories →
Also listed as affected (6) `6.0.0` `6.0.1` `6.0.2` `6.1.0` `6.1.1` `6.2.0`
`4.0.0-rc2` to before 4.2.4	`4.2.4`Advisories →
Also listed as affected (17) `4.0.0` `4.0.0-rc.2` `4.0.1` `4.0.2` `4.1.0` `4.1.1` `4.1.2` `4.1.3` `4.1.4` `4.1.5` `4.1.6` `4.1.7` `4.1.8` `4.2.0` `4.2.1` `4.2.2` `4.2.3`
`5` to before 5.3.1	`5.3.1`Advisories →
Also listed as affected (7) `5.0.0` `5.0.1` `5.0.2` `5.0.3` `5.1.0` `5.2.0` `5.3.0`

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`8.0` to before 8.1.7	`8.1.7`Advisories →
Also listed as affected (32) `8.0.0` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta8` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6`

bugsnag/bugsnag-laravel Packagist

All bugsnag/bugsnag-laravel advisories →

Affected	Fixed in
All versions before 2.0.2	`2.0.2`Advisories →
Also listed as affected (29) `v1.0.0` `v1.0.1` `v1.0.10` `v1.0.2` `v1.0.3` `v1.0.4` `v1.0.5` `v1.0.6` `v1.0.7` `v1.0.8` `v1.0.9` `v1.1.0` `v1.1.1` `v1.2.0` `v1.2.1` `v1.3.0` `v1.4.0` `v1.4.1` `v1.4.2` `v1.5.0` `v1.5.1` `v1.6.0` `v1.6.1` `v1.6.2` `v1.6.3` `v1.6.4` `v1.7.0` `v2.0.0` `v2.0.1`

amphp/artax Packagist

All amphp/artax advisories →

Affected	Fixed in
All versions before 1.0.4	`1.0.4`Advisories →
Also listed as affected (23) `v0.1.0` `v0.3.7` `v0.4.0` `v0.5.0` `v0.5.1` `v0.6.0` `v0.6.1` `v0.6.2` `v0.7.0` `v0.7.1` `v1.0.0` `v1.0.0-alpha` `v1.0.0-beta` `v1.0.0-beta2` `v1.0.0-rc1` `v1.0.0-rc2` `v1.0.0-rc3` `v1.0.0-rc4` `v1.0.0-rc5` `v1.0.0-rc6` `v1.0.1` `v1.0.2` `v1.0.3`
`2.0.0` to before 2.0.4	`2.0.4`Advisories →
Also listed as affected (4) `2.0.2` `v2.0.0` `v2.0.1` `v2.0.3`

padraic/humbug_get_contents Packagist

All padraic/humbug_get_contents advisories →

Affected	Fixed in
All versions before 1.1.2	`1.1.2`Advisories →
Also listed as affected (7) `1.0.0` `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1.0` `1.1.1`

Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.