Quick answers
- Is CVE-2016-1000111 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-1000111 being exploited in the wild.
- How severe is CVE-2016-1000111?
- Low severity, with a CVSS score of 3.1, published 11 March 2020.
- Which products and versions are affected?
- twisted (PyPI) ECOSYSTEM:introduced=0,fixed=16.3.1.
- Is there a fix for CVE-2016-1000111?
- Yes. twisted (PyPI): upgrade to 16.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-1000111 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2016-1000111?
- Check whether you run twisted (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- twisted (PyPI): upgrade to 16.3.1 or later
pip install "twisted>=16.3.1"
Technical details
The vulnerability stems from Twisted's failure to address RFC 3875 section 4.1.18 namespace conflicts. When handling CGI requests, Twisted does not sanitize untrusted client data in the HTTP_PROXY environment variable, enabling the "httpoxy" attack vector. An unauthenticated remote attacker can send a crafted Proxy header in an HTTP request to redirect the CGI application's outbound HTTP traffic to an arbitrary proxy server. The attack requires no authentication or user interaction and is network-reachable. A fix is available in Twisted 16.3.1 and later.
Affected products
- Twisted Twisted before 16.3.1
Identifiers
- CVE-2016-1000111
- GHSA-3gqj-cmxr-p4x2
- PYSEC-2020-214
Timeline
- 2021-04-30: disclosed
- 2016-03-24: patched: Fix released in version 16.3.1