Bug 1955316 (CVE-2021-31879)

Summary:	CVE-2021-31879 wget: authorization header disclosure on redirect
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, aegorenk, aprice, caswilli, cbuissar, hkataria, jkoehler, jnakfour, jorton, jsamir, jvasik, jwong, karsten, kaycoth, kholdawa, kshier, lcouzens, lphiri, micjohns, mruprich, mskarbek, oezr, rblanco, sthirugn, vkrizan, vmugicag
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in wget. If wget sends an Authorization header as part of a query and receives an HTTP REDIRECT to a third party in return, the Authorization header will be forwarded as part of the redirected request. This issue creates a password leak, as the second server receives the password. The highest threat from this vulnerability is confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-15 13:19:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1955317, 1971620, 1971623, 1973066, 1973067, 1973068, 1973070
Bug Blocks:	1955318

Description Guilherme de Almeida Suckevicz 2021-04-29 20:35:16 UTC

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

If wget sends an Authorization header to a Web server, and that server replies with a REDIRECT, that header will not be stripped, and thus be forwarded to the second web server. This creates a password leak, as the 2nd server receives the password.

Reference:
https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html

Comment 1 Guilherme de Almeida Suckevicz 2021-04-29 20:35:33 UTC

Created wget tracking bugs for this issue:

Affects: fedora-all [bug 1955317]

Comment 2 Cedric Buissart 2021-06-14 13:06:07 UTC

This was previously reported upstream already in 2019 via :
https://savannah.gnu.org/bugs/?56909