Amazon Linux Security Advisory for lighttpd: ALAS-2016-746

It was discovered that lighttpd class did not properly protect against the HTTP_PROXY variable name clash in a CGI context. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2016-746 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2016-746: Amazon Linux (lighttpd (1.4.41-1.34.amzn1) on i686)

ALAS-2016-746: Amazon Linux (lighttpd (1.4.41-1.34.amzn1) on x86_64)

ALAS-2016-746: Amazon Linux (lighttpd (1.4.41-1.34.amzn1) on src)