Bug 1643829 (CVE-2018-18074)
| Summary: | CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | abhgupta, ahardin, apevec, aurelien, bleanhar, ccoleman, chrisw, cstratak, databases-maint, dbaker, dedgar, dikonoor, eparis, fschwarz, gwync, hhorak, infra-sig, jeremy, jgoulding, jjoyce, jokerman, jorton, jschluet, j, kbasil, lbalhar, lhh, lpeer, markmc, mburns, mchappel, m.cyprian, mcyprian, metherid, mhayden, mhroncok, mrunge, ncoghlan, orion, python-maint, python-sig, rbryant, rhos-maint, sclewis, sisharma, slavek.kabrda, slinaber, smilner, steve.traylen, sthangav, tdecacqu, tflink, TicoTimo, torsava, trankin, vbellur |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | python-requests 2.20.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:20:27 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1643830, 1643831, 1643832, 1644301, 1645641, 1646799, 1646800, 1646801, 1646802, 1646803, 1646804, 1647368, 1647369, 1663101, 1682983, 1778141, 1778142, 1778143, 1778144, 1778145, 1778147, 1778148, 1778149, 1778150, 1778151, 1778152, 1778153, 1778154, 1778155, 1778156, 1778157, 1778158, 1804585, 1804586, 1804588, 1804589 | ||
| Bug Blocks: | 1643833 | ||
|
Description
Sam Fowler
2018-10-29 06:50:54 UTC
Created python-requests tracking bugs for this issue: Affects: fedora-all [bug 1643830] Affects: openstack-rdo [bug 1643832] When resolving a redirect, affected python-requests versions remove the Authorization header only when the original and the new hostname mismatch, instead of checking the scheme and port too. Thus Authorization header is sent when redirecting from HTTPS to HTTP servers with the same hostname. An attacker that can sniff the traffic in transit between these two hosts can also read the Authorization header in plain text. Does Red Hat plan to make an updated package available for RHEL ? This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2035 https://access.redhat.com/errata/RHSA-2019:2035 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-18074 Created python-pip tracking bugs for this issue: Affects: epel-6 [bug 1778141] Created python-pip-epel tracking bugs for this issue: Affects: epel-7 [bug 1778142] Created python-virtualenv tracking bugs for this issue: Affects: epel-6 [bug 1778147] Affects: fedora-30 [bug 1778145] Created python3-requests tracking bugs for this issue: Affects: epel-6 [bug 1778143] Affects: epel-7 [bug 1778144] Created python3-virtualenv tracking bugs for this issue: Affects: epel-7 [bug 1778148] This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0850 https://access.redhat.com/errata/RHSA-2020:0850 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0851 https://access.redhat.com/errata/RHSA-2020:0851 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1605 https://access.redhat.com/errata/RHSA-2020:1605 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1916 https://access.redhat.com/errata/RHSA-2020:1916 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:2068 https://access.redhat.com/errata/RHSA-2020:2068 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:2081 https://access.redhat.com/errata/RHSA-2020:2081 |