Описание
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | python-requests | Will not fix | ||
| Red Hat Enterprise Linux 8 | python36:3.6/python-virtualenv | Affected | ||
| Red Hat Enterprise Linux 8 | python-requests | Not affected | ||
| Red Hat OpenShift Container Platform 3.9 | python-requests | Affected | ||
| Red Hat OpenStack Platform 10 (Newton) | python-requests | Fix deferred | ||
| Red Hat OpenStack Platform 12 (Pike) | python-requests | Affected | ||
| Red Hat OpenStack Platform 13 (Queens) | python-requests | Fix deferred | ||
| Red Hat OpenStack Platform 14 (Rocky) | python-requests | Affected | ||
| Red Hat OpenStack Platform 8 (Liberty) | python-requests | Fix deferred | ||
| Red Hat OpenStack Platform 9 (Mitaka) | python-requests | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
2.6 Low
CVSS3
Связанные уязвимости
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
The Requests package before 2.20.0 for Python sends an HTTP Authorizat ...
EPSS
2.6 Low
CVSS3