Component Type: TYPO3 CMS

Release Date: July 19, 2016

 

Vulnerability Type: Environment Variable Injection

Affected Versions: Versions 8.0.0 to 8.2.0

Severity: Low

related CVE: CVE-2016-5385

Problem Description: PHP, when used as CGI, FPM or HHVM, exposes http headers also as environment variables starting with “HTTP_”. TYPO3 version 8.2.0 is vulnerable because it uses the third party library guzzlehttp/guzzlel, which makes use of the environment variable “HTTP_PROXY”. Read https://www.symfony.fi/entry/httpoxy-vulnerability-hits-php-installations-using-fastcgi-and-php-fpm-and-hhvm or https://httpoxy.org/ for further details.

Solution: Update to TYPO3 version 8.2.1 that fixes the problem described.

 

General Advice: Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.

General Note: All security related code changes are tagged so that you can easily look them up on our review system.