The flaw resides in the handling of the HTTP_PROXY environment variable by the urllib.request module, used internally by the HTTP server and client. When processing a maliciously crafted HTTP request ...