| Package | Affected versions | Patched versions |
|---|---|---|
| amphp/artax | ≥ 2.0.0, < 2.0.4< 1.0.4 | 2.0.41.0.4 |
| bugsnag/bugsnag-laravel | < 2.0.2 | 2.0.2 |
| drupal/core | ≥ 8.0, < 8.1.7 | 8.1.7 |
| guzzlehttp/guzzle | ≥ 4.0.0-rc2, < 4.2.4≥ 5, < 5.3.1≥ 6, < 6.2.1 | 4.2.45.3.16.2.1 |
| padraic/humbug_get_contents | < 1.1.2 | 1.1.2 |
| drupal | ≥ 8.0.0, < 8.1.7 | 8.1.7 |
| system management homepage | ≤ 7.5.5.0 | |
| communications user data repository | = 10.0.0= 10.0.1= 12.0.0 | |
| enterprise manager ops center | = 12.2.2= 12.3.2 | |
| php | ≥ 5.5.0, < 5.5.38≥ 5.6.0, < 5.6.24≥ 7.0.0, ≤ 7.0.8 | 5.5.385.6.24 |
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free