HighGHSA-m6ch-gg5f-wxx3CVE-2016-5385

HTTP Proxy header vulnerability

Published 7 Apr 2022 · Updated 8 Nov 2023

Affected packages

guzzlehttp/guzzleComposer

Affected: >=6 <6.2.1
Fixed in: 6.2.1

Update to the fixed version for your release line, for example:composer require guzzlehttp/guzzle:^6.2.1

guzzlehttp/guzzleComposer

Affected: >=4.0.0-rc2 <4.2.4
Fixed in: 4.2.4

Update to the fixed version for your release line, for example:composer require guzzlehttp/guzzle:^4.2.4

guzzlehttp/guzzleComposer

Affected: >=5 <5.3.1
Fixed in: 5.3.1

Update to the fixed version for your release line, for example:composer require guzzlehttp/guzzle:^5.3.1

drupal/coreComposer

Affected: >=8.0 <8.1.7
Fixed in: 8.1.7

Update to the fixed version for your release line, for example:composer require drupal/core:^8.1.7

bugsnag/bugsnag-laravelComposer

Affected: <2.0.2
Fixed in: 2.0.2

Update to the fixed version for your release line, for example:composer require bugsnag/bugsnag-laravel:^2.0.2

amphp/artaxComposer

Affected: <1.0.4
Fixed in: 1.0.4

Update to the fixed version for your release line, for example:composer require amphp/artax:^1.0.4

amphp/artaxComposer

Affected: >=2.0.0 <2.0.4
Fixed in: 2.0.4

Update to the fixed version for your release line, for example:composer require amphp/artax:^2.0.4

padraic/humbug_get_contentsComposer

Affected: <1.1.2
Fixed in: 1.1.2

Update to the fixed version for your release line, for example:composer require padraic/humbug_get_contents:^1.1.2

Details

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

Is GHSA-m6ch-gg5f-wxx3 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected guzzlehttp/guzzle, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.