Bug 1643829 (CVE-2018-18074) - CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
Summary: CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove A...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-18074
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1778148 1643830 1643831 1643832 1644301 1645641 1646799 1646800 1646801 1646802 1646803 1646804 1647368 1647369 1663101 1682983 1778141 1778142 1778143 1778144 1778145 1778147 1778149 1778150 1778151 1778152 1778153 1778154 1778155 1778156 1778157 1778158 1804585 1804586 1804588 1804589
Blocks: 1643833
TreeView+ depends on / blocked
 
Reported: 2018-10-29 06:50 UTC by Sam Fowler
Modified: 2021-02-16 22:51 UTC (History)
56 users (show)

Fixed In Version: python-requests 2.20.0
Doc Type: If docs needed, set a value
Doc Text:
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials.
Clone Of:
Environment:
Last Closed: 2019-08-06 13:20:27 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2035 0 None None None 2019-08-06 12:04:59 UTC
Red Hat Product Errata RHSA-2020:0850 0 None None None 2020-03-17 16:18:21 UTC
Red Hat Product Errata RHSA-2020:0851 0 None None None 2020-03-17 16:18:42 UTC
Red Hat Product Errata RHSA-2020:1605 0 None None None 2020-04-28 15:29:11 UTC
Red Hat Product Errata RHSA-2020:1916 0 None None None 2020-04-28 16:08:39 UTC
Red Hat Product Errata RHSA-2020:2068 0 None None None 2020-05-12 18:37:48 UTC
Red Hat Product Errata RHSA-2020:2081 0 None None None 2020-05-12 18:38:01 UTC

Internal Links: 1745417 1754830

Description Sam Fowler 2018-10-29 06:50:54 UTC 
Python Requests before version 2.20.0 does not remove the HTTP Authorization header when following a HTTPS to HTTP redirect, allowing for the potential transmission of user credentials in plaintext.


Upstream Patch:

https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff


Upstream Issue:

https://github.com/requests/requests/pull/4718
Comment 1 Sam Fowler 2018-10-29 06:51:51 UTC 
Created python-requests tracking bugs for this issue:

Affects: fedora-all [bug 1643830]
Affects: openstack-rdo [bug 1643832]
Comment 7 Riccardo Schirone 2018-11-07 10:38:41 UTC 
When resolving a redirect, affected python-requests versions remove the Authorization header only when the original and the new hostname mismatch, instead of checking the scheme and port too. Thus Authorization header is sent when redirecting from HTTPS to HTTP servers with the same hostname. An attacker that can sniff the traffic in transit between these two hosts can also read the Authorization header in plain text.
Comment 10 Divya 2019-02-08 11:07:14 UTC 
Does Red Hat plan to make an updated package available for RHEL ?
Comment 12 errata-xmlrpc 2019-08-06 12:04:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2035 https://access.redhat.com/errata/RHSA-2019:2035
Comment 13 Product Security DevOps Team 2019-08-06 13:20:27 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-18074
Comment 14 Tomas Hoger 2019-11-29 11:44:22 UTC 
Created python-pip tracking bugs for this issue:

Affects: epel-6 [bug 1778141]


Created python-pip-epel tracking bugs for this issue:

Affects: epel-7 [bug 1778142]


Created python-virtualenv tracking bugs for this issue:

Affects: epel-6 [bug 1778147]
Affects: fedora-30 [bug 1778145]


Created python3-requests tracking bugs for this issue:

Affects: epel-6 [bug 1778143]
Affects: epel-7 [bug 1778144]


Created python3-virtualenv tracking bugs for this issue:

Affects: epel-7 [bug 1778148]
Comment 16 errata-xmlrpc 2020-03-17 16:18:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0850 https://access.redhat.com/errata/RHSA-2020:0850
Comment 17 errata-xmlrpc 2020-03-17 16:18:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0851 https://access.redhat.com/errata/RHSA-2020:0851
Comment 18 errata-xmlrpc 2020-04-28 15:29:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1605 https://access.redhat.com/errata/RHSA-2020:1605
Comment 19 errata-xmlrpc 2020-04-28 16:08:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1916 https://access.redhat.com/errata/RHSA-2020:1916
Comment 20 errata-xmlrpc 2020-05-12 18:37:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2068 https://access.redhat.com/errata/RHSA-2020:2068
Comment 21 errata-xmlrpc 2020-05-12 18:37:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2081 https://access.redhat.com/errata/RHSA-2020:2081
Note You need to log in before you can comment on or make changes to this bug.