Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
References
Configurations
History
13 Feb 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| References |
|
|
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/ - Mailing List, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html - | |
| References | () https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 - Patch | |
| References | () https://github.com/psf/requests/releases/tag/v2.31.0 - Release Notes | |
| References | () https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q - Vendor Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/ - | |
| Summary | Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0. |
18 Jun 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Jun 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE | CWE-200 |
02 Jun 2023, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:python:requests:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
|
| First Time |
Python requests
Python Fedoraproject fedora Fedoraproject |
|
| References | (MISC) https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 - Patch | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/ - Mailing List, Third Party Advisory | |
| References | (MISC) https://github.com/psf/requests/releases/tag/v2.31.0 - Release Notes | |
| References | (MISC) https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q - Vendor Advisory | |
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
27 May 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 May 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-26 18:15
Updated : 2025-02-13 17:16
NVD link : CVE-2023-32681
Mitre link : CVE-2023-32681
JSON object : View
Products Affected
python
- requests
fedoraproject
- fedora
CWE