Bug 1643829 (CVE-2018-18074)

Summary: CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abhgupta, ahardin, apevec, aurelien, bleanhar, ccoleman, chrisw, cstratak, databases-maint, dbaker, dedgar, dikonoor, eparis, fschwarz, gwync, hhorak, infra-sig, jeremy, jgoulding, jjoyce, jokerman, jorton, jschluet, kbasil, lbalhar, lhh, lpeer, markmc, mburns, mchappel, m.cyprian, mcyprian, metherid, mhayden, mhroncok, mrunge, ncoghlan, orion, python-maint, python-sig, rbryant, rhos-maint, sclewis, sisharma, slavek.kabrda, slinaber, smilner, steve.traylen, sthangav, tdecacqu, tflink, tibbs, TicoTimo, torsava, trankin, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: python-requests 2.20.0 Doc Type: If docs needed, set a value
Doc Text:
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-08-06 13:20:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1663101, 1778141, 1778147, 1778148, 1778149, 1778154, 1778156, 1643830, 1643831, 1643832, 1644301, 1645641, 1646799, 1646800, 1646801, 1646802, 1646803, 1646804, 1647368, 1647369, 1682983, 1778142, 1778143, 1778144, 1778145, 1778150, 1778151, 1778152, 1778153, 1778155, 1778157, 1778158, 1804585, 1804586, 1804588, 1804589    
Bug Blocks: 1643833    

Description Sam Fowler 2018-10-29 06:50:54 UTC
Python Requests before version 2.20.0 does not remove the HTTP Authorization header when following a HTTPS to HTTP redirect, allowing for the potential transmission of user credentials in plaintext.


Upstream Patch:

https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff


Upstream Issue:

https://github.com/requests/requests/pull/4718

Comment 1 Sam Fowler 2018-10-29 06:51:51 UTC
Created python-requests tracking bugs for this issue:

Affects: fedora-all [bug 1643830]
Affects: openstack-rdo [bug 1643832]

Comment 7 Riccardo Schirone 2018-11-07 10:38:41 UTC
When resolving a redirect, affected python-requests versions remove the Authorization header only when the original and the new hostname mismatch, instead of checking the scheme and port too. Thus Authorization header is sent when redirecting from HTTPS to HTTP servers with the same hostname. An attacker that can sniff the traffic in transit between these two hosts can also read the Authorization header in plain text.

Comment 10 Divya 2019-02-08 11:07:14 UTC
Does Red Hat plan to make an updated package available for RHEL ?

Comment 12 errata-xmlrpc 2019-08-06 12:04:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2035 https://access.redhat.com/errata/RHSA-2019:2035

Comment 13 Product Security DevOps Team 2019-08-06 13:20:27 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-18074

Comment 14 Tomas Hoger 2019-11-29 11:44:22 UTC
Created python-pip tracking bugs for this issue:

Affects: epel-6 [bug 1778141]


Created python-pip-epel tracking bugs for this issue:

Affects: epel-7 [bug 1778142]


Created python-virtualenv tracking bugs for this issue:

Affects: epel-6 [bug 1778147]
Affects: fedora-30 [bug 1778145]


Created python3-requests tracking bugs for this issue:

Affects: epel-6 [bug 1778143]
Affects: epel-7 [bug 1778144]


Created python3-virtualenv tracking bugs for this issue:

Affects: epel-7 [bug 1778148]

Comment 16 errata-xmlrpc 2020-03-17 16:18:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0850 https://access.redhat.com/errata/RHSA-2020:0850

Comment 17 errata-xmlrpc 2020-03-17 16:18:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0851 https://access.redhat.com/errata/RHSA-2020:0851

Comment 18 errata-xmlrpc 2020-04-28 15:29:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1605 https://access.redhat.com/errata/RHSA-2020:1605

Comment 19 errata-xmlrpc 2020-04-28 16:08:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1916 https://access.redhat.com/errata/RHSA-2020:1916

Comment 20 errata-xmlrpc 2020-05-12 18:37:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2068 https://access.redhat.com/errata/RHSA-2020:2068

Comment 21 errata-xmlrpc 2020-05-12 18:37:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2081 https://access.redhat.com/errata/RHSA-2020:2081