IBM HTTP Server: CVE-2016-5387: Apache HTTP Server could allow a remote attacker to redirect HTTP traffic of CGI application, caused by the lack of protection of untrusted client data in the HTTP_PROXY environment variable

Apache HTTP Server could allow a remote attacker to redirect HTTP traffic of CGI application, caused by the lack of protection of untrusted client data in the HTTP_PROXY environment variable. By using a specially-crafted Proxy header in a HTTP request, a remote attacker could exploit this vulnerability to redirect outbound HTTP traffic to arbitrary proxy server, also known as the HTTPOXY vulnerability.