Python Requests before version 2.20.0 does not remove the HTTP Authorization header when following a HTTPS to HTTP redirect, allowing for the potential transmission of user credentials in plaintext.
Created python-requests tracking bugs for this issue:
Affects: fedora-all [bug 1643830]
Affects: openstack-rdo [bug 1643832]
When resolving a redirect, affected python-requests versions remove the Authorization header only when the original and the new hostname mismatch, instead of checking the scheme and port too. Thus Authorization header is sent when redirecting from HTTPS to HTTP servers with the same hostname. An attacker that can sniff the traffic in transit between these two hosts can also read the Authorization header in plain text.
Does Red Hat plan to make an updated package available for RHEL ?
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2019:2035 https://access.redhat.com/errata/RHSA-2019:2035
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):