Date: Tue, 13 Sep 2016 14:57:01 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: libxml with CGI fix On Tue, 13 Sep 2016, watashiwaher wrote: > Hi, huys! There is a known httpoxy vulnerability ( https://httpoxy.org/ ). > There is a problem with CGI usage in all application which use libxml2 > library. Attacker can make requests via attacker proxy from target server > using this vulnerability. I reported this problem in the 5th august, but > developers didn't reply me at all, and I don't know if they want to > response. The referenced web site provides the advice "Do it “at the edge”, where HTTP requests first enter your system.". In this case libxml2 is not the edge. The edge is the parser which accepts the CGI requests. Adding detection of "REQUEST_METHOD" to libxml2 may reduce the potential menace. The libxml2 developers should have responded to you but I can see why they would not consider this to be their problem. If you break libxml2 support for HTTP_PROXY (and/or http_proxy) then the proxy capabilty can't be used outside of CGI applications, which is likely to break existing valid uses. Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.