Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 18 Jul 2016 14:23:41 -0400
From: Jan Schaumann <jschauma@...meister.org>
To: oss-security@...ts.openwall.com
Subject: Re: A CGI application vulnerability for PHP, Go,
 Python and others

Richard Rowe <arch.richard@...il.com> wrote:
 
> The consequence is that an attacker can force a proxy of their choice to be
> used. This proxy receives the full request for anything sent over HTTP
> using a vulnerable client. It can also act in a malicious way to tie up
> server resources (a "reverse slowloris").

I know you mentioned it on https://httpoxy.org/, but I think it's worth
stressing explicitly again:  use of HTTPS for all requests made by the
application, internal as well as external, defeats this vulnerability
(provided certificates are actually verified).

-Jan

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.