{"id":"CVE-2016-1000104","aliases":["AZL-36963","AZL-7290","EUVD-2016-1049","GHSA-3qww-55h8-4xjp","MGASA-2017-0203","OESA-2022-1758","SUSE-SU-2016:1820-1","UBUNTU-CVE-2016-1000104","openSUSE-SU-2024:10564-1"],"status":"published","title":"A security Bypass vulnerability exists in mod_fcgid through 2016-07-07 in the FcgidPassHeader Proxy.","description":"A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02228,"percentile":0.8284,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-07-18T14:06:32Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Mageia:5","package":"apache-mod_fcgid","fixed_in":["2.3.9-4.1.mga5"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"mod_fcgid","fixed_in":["2.3.9-20.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"mod_fcgid","fixed_in":["2.3.9-20.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"mod_fcgid","fixed_in":["2.3.9-21.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"apache2-mod_fcgid","fixed_in":["2.2-31.29.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"mod_fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.9-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mod_fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.9-21"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"apache-mod_fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-4.1.mga5"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"mod_fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-20.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"mod_fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-20.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"mod_fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-21.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"apache2-mod_fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-31.29.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.9-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.9-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.9-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libapache2-mod-fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.9-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libapache2-mod-fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.9-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libapache2-mod-fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.9-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libapache2-mod-fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.9-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libapache2-mod-fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3.9-4","1:2.3.9-4build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_fcgid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-7.3"}]}],"bundled":3}],"products":[{"vendor":"apache","product":"mod_fcgid"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/07/18/6","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00084.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/91822","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.tenable.com/security/tns-2017-04","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000104","tags":["web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000104"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-1000104"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1000104"},{"url":"https://github.com/advisories/GHSA-3qww-55h8-4xjp"},{"url":"https://advisories.mageia.org/MGASA-2017-0203.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19237","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2016-08/msg00084.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1758","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161820-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/988492","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000104","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-1000104","tags":["report"]},{"url":"https://marc.info/?l=oss-security\u0026m=146885145004975\u0026w=2","tags":["report"]},{"url":"https://www.apache.org/security/asf-httpoxy-response.txt","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1000104","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4365","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-1000104","description":"A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.","status":"published","published":"2019-12-03T21:12:15Z","modified":"2024-08-06T03:55:26.411Z","updated_at":"2026-11-02T14:33:36.802481Z"}],"euvd":[{"id":"EUVD-2016-1049","description":"A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.","status":"published","published":"2019-12-03T21:12:15Z","modified":"2024-08-06T03:55:26Z","updated_at":"2026-11-03T02:22:21.756675Z"}],"ghsa":[{"id":"GHSA-3qww-55h8-4xjp","title":"A security Bypass vulnerability exists in mod_fcgid through 2016-07-07 in the FcgidPassHeader Proxy.","description":"A security Bypass vulnerability exists in mod_fcgid through 2016-07-07 in the FcgidPassHeader Proxy.","status":"published","published":"2022-05-24T17:02:31Z","modified":"2024-04-04T02:41:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:56:11.047077Z"}],"nvd":[{"id":"CVE-2016-1000104","description":"A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.","status":"published","published":"2019-12-03T22:15:13.48Z","modified":"2026-06-17T00:38:41.107Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"AZL-36963","title":"CVE-2016-1000104 affecting package mod_fcgid 2.3.9-21","description":"A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.","status":"published","published":"2019-12-03T22:15:13Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-7290","title":"CVE-2016-1000104 affecting package mod_fcgid 2.3.9-21","description":"A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.","status":"published","published":"2019-12-03T22:15:13Z","modified":"2026-04-21T04:33:45.522994Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"OESA-2022-1758","title":"mod_fcgid security update","description":"Mod_fcgid is an Apache module providing a FastCGI interface. It\u0026apos;s an alternative to mod_fastcgi that is specifically tuned for the dynamic FastCGI configuration used on DreamHost servers.\r\n\r\nSecurity Fix(es):\r\n\r\nA security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.(CVE-2016-1000104)","status":"published","published":"2022-07-22T11:05:01Z","modified":"2026-08-18T01:16:45.09854672Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2016-1000104","description":"A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.","status":"published","published":"2019-12-03T22:15:00Z","modified":"2026-10-17T12:52:32.737675467Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"MGASA-2017-0203","title":"Updated apache-mod_fcgid packages fix security vulnerability","description":"A remote attacker could have set the HTTP_PROXY environment variable of\nCGI scripts (CVE-2016-1000104).\n","status":"published","published":"2017-07-13T09:10:46Z","modified":"2026-04-16T06:25:28.057332828Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10564-1","title":"apache2-mod_fcgid-2.3.9-7.3 on GA media","description":"These are all security issues fixed in the apache2-mod_fcgid-2.3.9-7.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:09.783027Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:1820-1","title":"Security update for apache2-mod_fcgid","description":"\nThis update for apache2-mod_fcgid fixes the following issues:\n \n* It used to be possible to set an arbitrary $HTTP_PROXY environment variable\n  for request handlers -- like CGI scripts -- by including a specially crafted\n  HTTP header in the request (CVE-2016-1000104). As a result, these server\n  components would potentially direct all their outgoing HTTP traffic through a\n  malicious proxy server. This patch fixes the issue: the updated Apache server\n  ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes\n  (unless a value has been explicitly configured by the administrator in the\n  configuration file). (bsc#988492)\n","status":"published","published":"2016-07-18T14:06:32Z","modified":"2026-02-04T03:00:54.246105Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}