Unintended Leaks Of Proxy-Authorization Header

2023-05-2402:21:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

proxy-authorization

vulnerability

requests

https

credentials

redirects

0.002 Low

EPSS

Percentile

51.8%

JSON

requests is vulnerable to Unintended Leaks Of Proxy-Authorization Header. The vulnerability exists in the rebuild_proxies function of sessions.py when the credentials are supplied in the URL user information component such as https://username:password@proxy:8080, which allows an attacker to gain Proxy-Authorization header information through the destination servers during redirects to an HTTPS origin.

CPENameOperatorVersion
requestsle2.30.0
requests2eq2.16.0
python38eq3.8.0__6.module_el8.2.0+317+61fa6e7d
python38eq3.8.0__4.module_el8.1.0+287+c25ecda6
python3x-requestseq2.28.2__1.el8ap
python-requestseq2.19.1__6.el7
python-requestseq2.4.3__1.el6_6sat
python-requestseq2.19.1__4.el7ost
python-requestseq2.6.0__3.el6
python-requestseq1.1.0__8.1.el7ost

Name	Operator	Version
requests	le	2.30.0
requests2	eq	2.16.0
python38	eq	3.8.0__6.module_el8.2.0+317+61fa6e7d
python38	eq	3.8.0__4.module_el8.1.0+287+c25ecda6
python3x-requests	eq	2.28.2__1.el8ap
python-requests	eq	2.19.1__6.el7
python-requests	eq	2.4.3__1.el6_6sat
python-requests	eq	2.19.1__4.el7ost
python-requests	eq	2.6.0__3.el6
python-requests	eq	1.1.0__8.1.el7ost