Security update for python-Twisted SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0114-1 Final 1 1 2017-01-12T10:36:01Z current 2017-01-12T10:36:01Z 2017-01-12T10:36:01Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-Twisted This update for python-Twisted fixes the following issues: - CVE-2016-1000111: sets environmental variable HTTP_PROXY based on user supplied Proxy request header (bsc#989997) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Web-Scripting-12-2017-56,SUSE-Storage-3-2017-56,SUSE-Storage-4-2017-56 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170114-1/ Link for SUSE-SU-2017:0114-1 https://lists.suse.com/pipermail/sle-security-updates/2017-January/002557.html E-Mail link for SUSE-SU-2017:0114-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/989997 SUSE Bug 989997 https://www.suse.com/security/cve/CVE-2016-1000111/ SUSE CVE CVE-2016-1000111 page SUSE Enterprise Storage 3 SUSE Enterprise Storage 4 SUSE Linux Enterprise Module for Web and Scripting 12 python-Twisted-15.2.1-8.1 python-Twisted-15.2.1-8.1 as a component of SUSE Enterprise Storage 3 python-Twisted-15.2.1-8.1 as a component of SUSE Enterprise Storage 4 python-Twisted-15.2.1-8.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. CVE-2016-1000111 SUSE Enterprise Storage 3:python-Twisted-15.2.1-8.1 SUSE Enterprise Storage 4:python-Twisted-15.2.1-8.1 SUSE Linux Enterprise Module for Web and Scripting 12:python-Twisted-15.2.1-8.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170114-1/ https://www.suse.com/security/cve/CVE-2016-1000111.html CVE-2016-1000111 https://bugzilla.suse.com/989997 SUSE Bug 989997