Bug 2209469 (CVE-2023-32681)

Summary:	CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, apevec, bbuckingham, bcourt, cstratak, cwelton, davidn, eglynn, ehelms, epacific, gtanzill, hhorak, jcammara, jhardy, jjoyce, jneedle, jobarker, jorton, jsherril, kshier, lhh, lzap, mabashia, mburns, mgarciac, mhulan, mminar, myarboro, nmoumoul, orabin, osapryki, pcreech, python-maint, rbiba, rchan, rhos-maint, simaishi, smcdonal, spower, sskracic, stcannon, teagle, tfister, torsava, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuild_proxies is used to recompute and reattach the Proxy-Authorization header to requests when redirected. This behavior only affects proxied requests when credentials are supplied in the URL user information component (for example, https://username:password@proxy:8080).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2209473, 2209474, 2209475, 2209476, 2209477, 2209479, 2209481, 2209673, 2209471, 2209472, 2209478, 2209480, 2209651
Bug Blocks:	2209260

Description Sandipan Roy 2023-05-24 03:06:19 UTC

Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding of `Proxy-Authorization` headers to destination servers when
following HTTPS redirects.

When proxies are defined with user info (https://user:pass@proxy:8080), Requests
will construct a `Proxy-Authorization` header that is attached to the request to
authenticate with the proxy.

In cases where Requests receives a redirect response, it previously reattached
the `Proxy-Authorization` header incorrectly, resulting in the value being
sent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are *strongly* encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.

Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.

[Github Security Advisory](https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q)

Comment 1 Sandipan Roy 2023-05-24 03:12:07 UTC

Created mingw-python-requests tracking bugs for this issue:

Affects: fedora-all [bug 2209471]


Created python-requests tracking bugs for this issue:

Affects: fedora-all [bug 2209472]
Affects: openstack-rdo [bug 2209473]

Comment 8 errata-xmlrpc 2023-08-01 08:49:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4350 https://access.redhat.com/errata/RHSA-2023:4350

Comment 9 errata-xmlrpc 2023-08-08 08:19:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4520 https://access.redhat.com/errata/RHSA-2023:4520