Prevent HTTPoxy attack (CVE-2016-1000110)
Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which
indicates that the script is in CGI mode.
Issue reported and patch contributed by Rémi Rampin.
diff --git a/Misc/ACKS b/Misc/ACKS
index 7aa8fc8..0210a4c 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -1123,6 +1123,7 @@
Jeff Ramnani
Varpu Rantala
Brodie Rao
+Rémi Rampin
Senko Rasic
Antti Rasinen
Nikolaus Rath
diff --git a/Misc/NEWS b/Misc/NEWS
index 06f10c9..a911bef 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -29,6 +29,10 @@
Library
-------
+- Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the
+ HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates
+ that the script is in CGI mode.
+
- Issue #27130: In the "zlib" module, fix handling of large buffers
(typically 2 or 4 GiB). Previously, inputs were limited to 2 GiB, and
compression and decompression operations did not properly handle results of