python-requests-2.25.1-7.el9
エラータID: AXSA:2023-6284:01
リリース日:
2023/08/03 Thursday - 04:10
題名:
python-requests-2.25.1-7.el9
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- python-requests の rebuild_proxies() 関数には、本来プロキシ
サーバーで削除される Proxy-Authorization ヘッダーに設定された
情報がリダイレクト先のサーバーに転送されてしまう問題がある
ため、リモートの攻撃者により、情報の漏洩を可能とする脆弱性が
存在します。(CVE-2023-32681)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-32681
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
追加情報:
N/A
ダウンロード:
SRPMS
- python-requests-2.25.1-7.el9.src.rpm
MD5: c6e482513f925fb6f42ffad00914c497
SHA-256: ef3acb22cadabcefc454191587d724e02b20482d0f5391fbd09c6ffad13848e7
Size: 3.57 MB
Asianux Server 9 for x86_64
- python3-requests-2.25.1-7.el9.noarch.rpm
MD5: 8734d1918bbce3860c6611a58952ee44
SHA-256: df609b8d9a7a27b0d1ddb7b8744082c5febbd560b40d0f50d5bda2b017a64599
Size: 112.60 kB - python3-requests+security-2.25.1-7.el9.noarch.rpm
MD5: 1f82a2b9fe3ed78174beb2e91f2e599a
SHA-256: d32002befee0d896686b171468c8a590c7828ed4c3e30af3dee5939d04c27c39
Size: 8.18 kB - python3-requests+socks-2.25.1-7.el9.noarch.rpm
MD5: 2a7f45fe5ba393ab06092604fa53c4a9
SHA-256: 8ad6d52f38cba51519937e31bf0048553f85d2370b1c1cf51dc01c58585db8c1
Size: 8.31 kB