Re: Apache's mod_remoteip: IP address spoofing via X-Forwarded-For when mod_rewrite rule is triggered

To: Debian LTS <debian-lts@lists.debian.org>
Cc: Andrey Zelenchuk <azelenchuk@plesk.com>, security <security@plesk.com>
Subject: Re: Apache's mod_remoteip: IP address spoofing via X-Forwarded-For when mod_rewrite rule is triggered
From: Utkarsh Gupta <utkarsh@debian.org>
Date: Sat, 9 May 2020 23:47:36 +0530
Message-id: <[🔎] CAPP0f977yi7M-YLHDKhx6JM7CA7cPbe-gjPYQp9a6jkuabgAug@mail.gmail.com>
In-reply-to: <[🔎] CABY6=0kbWBd0xm98jGB=zKOiNEWCEm9tnBQSgr61zjwK+RkBxA@mail.gmail.com>
References: <VI1PR09MB270239480458B1895BC5BFE5D8AD0@VI1PR09MB2702.eurprd09.prod.outlook.com> <20200430043105.GA373995@eldamar.local> <[🔎] CABY6=0kbWBd0xm98jGB=zKOiNEWCEm9tnBQSgr61zjwK+RkBxA@mail.gmail.com>

Hi,

On Sat, 2 May, 2020, 3:28 AM Ola Lundqvist, <ola@inguza.com> wrote:

Added the package to DLA needed.

Unless there's a CVE assigned for this, should I really be fixing it and announcing the update?

Best,

Utkarsh

Reply to:

Follow-Ups:
- Re: Apache's mod_remoteip: IP address spoofing via X-Forwarded-For when mod_rewrite rule is triggered
  - From: "Chris Lamb" <lamby@debian.org>

References:
- Re: Apache's mod_remoteip: IP address spoofing via X-Forwarded-For when mod_rewrite rule is triggered
  - From: Ola Lundqvist <ola@inguza.com>