CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 2CVE-2018-18074 – python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
https://notcve.org/view.php?id=CVE-2018-18074
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. El paquete Requests antes de la versión 2.20.0 para Python envía una cabecera de autorización HTTP a un URI http al recibir una redirección same-hostname https-to-http, lo que facilita que los atacantes remotos descibran las credenciales esnifando la red. A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials. • http://docs.python-requests.org/en/master/community/updates/#release-and-version-history http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html https://access.redhat.com/errata/RHSA-2019:2035 https://bugs.debian.org/910766 https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff https://github.com/requests/requests/issues/4716 https://github.com/requests/requests/pull/4718 https://usn.ubuntu.com/3790-1 https://usn.ubuntu.com/3790-2 https:/& • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.8EPSS: 1%CPEs: 14EXPL: 0CVE-2015-2296
https://notcve.org/view.php?id=CVE-2015-2296
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. La función resolve_redirects en sessions.py en requests 2.1.0 hasta 2.5.3 permite a atacantes remotos realizar ataques de fijación de sesión a través de una cookie sin valor de anfitrión en una redirección. • http://advisories.mageia.org/MGASA-2015-0120.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:133 http://www.openwall.com/lists/oss-security/2015/03/14/4 http://www.openwall.com/lists/oss-security/2015/03/15/1 http://www.ubuntu.com/usn/USN-2531-1 https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc https://warehouse.python.org/project/requests/2.6.0 •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2014-1829
https://notcve.org/view.php?id=CVE-2014-1829
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request. Requests(también conocido como python-requests) anterior a 2.3.0 permite a atacantes remotos obtener una contraseña netrc leyendo la cabecera 'Authorization' en una petición de redirección. • http://advisories.mageia.org/MGASA-2014-0409.html http://www.debian.org/security/2015/dsa-3146 http://www.mandriva.com/security/advisories?name=MDVSA-2015:133 http://www.ubuntu.com/usn/USN-2382-1 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108 https://github.com/kennethreitz/requests/issues/1885 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1830
https://notcve.org/view.php?id=CVE-2014-1830
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request. Requests (también conocido como python-requests) anterior a 2.3.0 permite a servidores remotos obtener información sensible leyendo la cabecera en 'Proxy-Authorization' con una petición de redirección. • http://advisories.mageia.org/MGASA-2014-0409.html http://lists.opensuse.org/opensuse-updates/2016-01/msg00095.html http://www.debian.org/security/2015/dsa-3146 http://www.mandriva.com/security/advisories?name=MDVSA-2015:133 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108 https://github.com/kennethreitz/requests/issues/1885 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •