| Package | Affected versions | Patched versions |
|---|---|---|
| http-client | ≤ 0.9 |
The "http-client" egg always used a HTTP_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even when running as a CGI process. Under several web servers this would mean a user-supplied "Proxy" header could allow an attacker to direct all HTTP requests through a proxy (also known as a "httpoxy" attack). This affects all versions of http-client before 0.10.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free