CVE-2018-18074

The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

The following packages have been upgraded to a later upstream version: python2 (2.7.17). (BZ#1759944)

Security Fix(es):

• python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)

• python: Cookie domain check returns incorrect results (CVE-2018-20852)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

• python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

• python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

The python-requests package contains a library designed to make HTTP requests easy for developers.

Bug fix:

• The fix CVE-2018-18074 leads to a regression (BZ#1758261)

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

The following packages have been upgraded to a later upstream version: python2 (2.7.17). (BZ#1759944)

Security Fix(es):

• python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)

• python: Cookie domain check returns incorrect results (CVE-2018-20852)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

• python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

• python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

It was discovered that Requests incorrectly handled certain HTTP headers. An attacker could possibly use this issue to access sensitive information (CVE-2018-18074).

This update for python-requests to version 2.20.1 fixes the following issues:

Security issue fixed:

• CVE-2018-18074: Fixed an information disclosure vulnerability of the HTTP Authorization header (bsc#1111622).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the python36-requests-2.25.1-4.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-requests-2.32.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-requests-2.34.2-1.2 package on the GA media of openSUSE Tumbleweed.

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Root has patched CVE-2018-18074 in the rootio-requests package for Root:PyPI. Multiple fixed versions available.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for python-requests to version 2.20.1 fixes the following issues:

Security issue fixed:

• CVE-2018-18074: Fixed an information disclosure vulnerability of the HTTP Authorization header (bsc#1111622).

This update for python-requests to version 2.20.1 fixes the following issues:

Security issue fixed:

• CVE-2018-18074: Fixed an information disclosure vulnerability of the HTTP Authorization header (bsc#1111622).

This update for python-requests fixes the following issues:

• CVE-2018-18074: Fixed an issue which could ease attackers to discover credentials by sniffing the network (bsc#1111622).

This update for python-requests to version 2.20.1 fixes the following issues:

Security issue fixed:

• CVE-2018-18074: Fixed an information disclosure vulnerability of the HTTP Authorization header (bsc#1111622).

This update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer, python-jsonpatch, python-jsonpointer, python-scandir, python-PyYAML fixes the following issues:

python-cfn-lint was included as a new package in 0.21.4.

python-aws-sam-translator was updated to 1.11.0:

• Add ReservedConcurrentExecutions to globals
• Fix ElasticsearchHttpPostPolicy resource reference
• Support using AWS::Region in Ref and Sub
• Documentation and examples updates
• Add VersionDescription property to Serverless::Function
• Update ServerlessRepoReadWriteAccessPolicy
• Add additional template validation

Upgrade to 1.10.0:

• Add GSIs to DynamoDBReadPolicy and DynamoDBCrudPolicy
• Add DynamoDBReconfigurePolicy
• Add CostExplorerReadOnlyPolicy and OrganizationsListAccountsPolicy
• Add EKSDescribePolicy
• Add SESBulkTemplatedCrudPolicy
• Add FilterLogEventsPolicy
• Add SSMParameterReadPolicy
• Add SESEmailTemplateCrudPolicy
• Add s3:PutObjectAcl to S3CrudPolicy
• Add allow_credentials CORS option
• Add support for AccessLogSetting and CanarySetting Serverless::Api properties
• Add support for X-Ray in Serverless::Api
• Add support for MinimumCompressionSize in Serverless::Api
• Add Auth to Serverless::Api globals
• Remove trailing slashes from APIGW permissions
• Add SNS FilterPolicy and an example application
• Add Enabled property to Serverless::Function event sources
• Add support for PermissionsBoundary in Serverless::Function
• Fix boto3 client initialization
• Add PublicAccessBlockConfiguration property to S3 bucket resource
• Make PAY_PER_REQUEST default mode for Serverless::SimpleTable
• Add limited support for resolving intrinsics in Serverless::LayerVersion
• SAM now uses Flake8
• Add example application for S3 Events written in Go
• Updated several example applications

• Initial build
  • Version 1.9.0
• Add patch to drop compatible releases operator from setup.py, required for SLES12 as the setuptools version is too old
  • ast_drop-compatible-releases-operator.patch

python-jsonschema was updated to 2.6.0:

• Improved performance on CPython by adding caching around ref resolution

Update to version 2.5.0:

• Improved performance on CPython by adding caching around ref resolution (#203)

Update to version 2.4.0:

• Added a CLI (#134)
• Added absolute path and absolute schema path to errors (#120)
• Added relevance
• Meta-schemas are now loaded via pkgutil
• Added by_relevance and best_match (#91)
• Fixed format to allow adding formats for non-strings (#125)
• Fixed the uri format to reject URI references (#131)

• Install /usr/bin/jsonschema with update-alternatives support

python-nose2 was updated to 0.9.1:

• the prof plugin now uses cProfile instead of hotshot for profiling
• skipped tests now include the user's reason in junit XML's message field
• the prettyassert plugin mishandled multi-line function definitions
• Using a plugin's CLI flag when the plugin is already enabled via config no longer errors
• nose2.plugins.prettyassert, enabled with --pretty-assert
• Cleanup code for EOLed python versions
• Dropped support for distutils.
• Result reporter respects failure status set by other plugins
• JUnit XML plugin now includes the skip reason in its output

Upgrade to 0.8.0:

List of changes is too long to show here, see https://github.com/nose-devs/nose2/blob/master/docs/changelog.rst changes between 0.6.5 and 0.8.0

Update to 0.7.0:

• Added parameterized_class feature, for parameterizing entire test classes (many thanks to @TobyLL for their suggestions and help testing!)
• Fix DeprecationWarning on inspect.getargs (thanks @brettdh; https://github.com/wolever/parameterized/issues/67)
• Make sure that setUp and tearDown methods work correctly (#40)
• Raise a ValueError when…

This update for python3-requests provides the following fix:

python-requests was updated to 2.20.1.

Update to version 2.20.1:

• Fixed bug with unintended Authorization header stripping for redirects using default ports (http/80, https/443).

Update to version 2.20.0:

• Bugfixes

  • Content-Type header parsing is now case-insensitive (e.g. charset=utf8 v Charset=utf8).
  • Fixed exception leak where certain redirect urls would raise uncaught urllib3 exceptions.
  • Requests removes Authorization header from requests redirected from https to http on the same hostname. (CVE-2018-18074)
  • should_bypass_proxies now handles URIs without hostnames (e.g. files).

Update to version 2.19.1:

• Fixed issue where status_codes.py’s init function failed trying to append to a doc value of None.

Update to version 2.19.0:

• Improvements

  • Warn about possible slowdown with cryptography version < 1.3.4
  • Check host in proxy URL, before forwarding request to adapter.
  • Maintain fragments properly across redirects. (RFC7231 7.1.2)
  • Removed use of cgi module to expedite library load time.
  • Added support for SHA-256 and SHA-512 digest auth algorithms.
  • Minor performance improvement to Request.content.

• Bugfixes

  • Parsing empty Link headers with parse_header_links() no longer return one bogus entry.
  • Fixed issue where loading the default certificate bundle from a zip archive would raise an IOError.
  • Fixed issue with unexpected ImportError on windows system which do not support winreg module.
  • DNS resolution in proxy bypass no longer includes the username and password in the request. This also fixes the issue of DNS queries failing on macOS.
  • Properly normalize adapter prefixes for url comparison.
  • Passing None as a file pointer to the files param no longer raises an exception.
  • Calling copy on a RequestsCookieJar will now preserve the cookie policy correctly.

Update to version 2.18.4:

• Improvements

  • Error messages for invalid headers now include the header name for easier debugging

Update to version 2.18.3:

• Improvements
  • Running $ python -m requests.help now includes the installed version of idna.
• Bugfixes
  • Fixed issue where Requests would raise ConnectionError instead of SSLError when encountering SSL problems when using urllib3 v1.22.

• Add ca-certificates (and ca-certificates-mozilla) to dependencies, otherwise https connections will fail.

This update for python-requests fixes the following issues:

• CVE-2018-18074: Fixed sending an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect (bsc#1111622)

This update for python-requests fixes the following issues:

• CVE-2018-18074: Fixed to prevent the package to send an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect. (bsc#1111622)

It was discovered that Requests incorrectly handled certain HTTP headers. An attacker could possibly use this issue to access sensitive information.