Bug 1643829 (CVE-2018-18074) - CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
Summary: CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove A...
Alias: CVE-2018-18074
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1643832 1644301 1646801 1646803 1646804 1663101 1682983 1643830 1643831 1645641 1646799 1646800 1646802 1647368 1647369
Blocks: 1643833
TreeView+ depends on / blocked
Reported: 2018-10-29 06:50 UTC by Sam Fowler
Modified: 2019-09-29 15:01 UTC (History)
37 users (show)

Fixed In Version: python-requests 2.20.0
Doc Type: If docs needed, set a value
Doc Text:
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials.
Clone Of:
Last Closed: 2019-08-06 13:20:27 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2035 None None None 2019-08-06 12:04:59 UTC

Internal Links: 1745417 1754830

Description Sam Fowler 2018-10-29 06:50:54 UTC
Python Requests before version 2.20.0 does not remove the HTTP Authorization header when following a HTTPS to HTTP redirect, allowing for the potential transmission of user credentials in plaintext.

Upstream Patch:


Upstream Issue:


Comment 1 Sam Fowler 2018-10-29 06:51:51 UTC
Created python-requests tracking bugs for this issue:

Affects: fedora-all [bug 1643830]
Affects: openstack-rdo [bug 1643832]

Comment 7 Riccardo Schirone 2018-11-07 10:38:41 UTC
When resolving a redirect, affected python-requests versions remove the Authorization header only when the original and the new hostname mismatch, instead of checking the scheme and port too. Thus Authorization header is sent when redirecting from HTTPS to HTTP servers with the same hostname. An attacker that can sniff the traffic in transit between these two hosts can also read the Authorization header in plain text.

Comment 10 Divya 2019-02-08 11:07:14 UTC
Does Red Hat plan to make an updated package available for RHEL ?

Comment 12 errata-xmlrpc 2019-08-06 12:04:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2035 https://access.redhat.com/errata/RHSA-2019:2035

Comment 13 Product Security DevOps Team 2019-08-06 13:20:27 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.