Fedora 30 update for yaws



| Updated: 2025-04-24
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2016-1000108
CWE-ID CWE-601
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

yaws
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Open redirect

EUVDB-ID: #VU34982

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1000108

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

yaws: before 2.0.6-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-aa7f37cd4d


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###