Bug 897658 (CVE-2014-1829) - VUL-1: CVE-2014-1829 CVE-2014-1830: python-requests: Proxy-Authorization header leak
Summary: VUL-1: CVE-2014-1829 CVE-2014-1830: python-requests: Proxy-Authorization head...
Status: RESOLVED FIXED
Alias: CVE-2014-1829
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.1
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Bernhard Wiedemann
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/106475/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-22 05:31 UTC by Marcus Meissner
Modified: 2016-04-27 18:59 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2014-09-22 05:31:53 UTC
via oss-sec

From: Jakub Wilk <jwilk@debian.org>
Subject: [oss-security] python-requests: CVE-2014-1829, CVE-2014-1830: password disclosure on redirect
Date: Fri, 19 Sep 2014 22:10:01 +0200

FYI: a while ago python-requests 2.3.0 was released, with the following 
bugfix:

* No longer expose Authorization or Proxy-Authorization headers on 
redirect. Fix CVE-2014-1829 and CVE-2014-1830 respectively.


References:
https://bugs.debian.org/733108
https://github.com/kennethreitz/requests/issues/1885
https://bugzilla.redhat.com/show_bug.cgi?id=1046626

-- 
Jakub Wilk
Comment 1 Marcus Meissner 2014-09-22 11:45:06 UTC
on SUSE cloud and on openSUSE only.

does it access anything outside of the cloud products scope on cloud?
Comment 2 Swamp Workflow Management 2014-10-01 12:06:23 UTC
bugbot adjusting priority
Comment 3 Bernhard Wiedemann 2014-10-01 12:39:58 UTC
(In reply to Marcus Meissner from comment #1)
> does it access anything outside of the cloud products scope on cloud?

In principle the python-*client packages (e.g. nova) use python-requests
and could be used on client machines to access other OpenStack clouds
Comment 4 Dirk Mueller 2015-02-13 15:31:50 UTC
(In reply to Marcus Meissner from comment #1)
> on SUSE cloud and on openSUSE only.

??? The packages are Also on SLE12.
Comment 5 Johannes Segitz 2015-02-13 15:42:02 UTC
(In reply to Dirk Mueller from comment #4)
They are on sle-ha 12.0 and sle-module-public-cloud 12.0, which probably didn't exist when Marcus wrote this comment.
Comment 7 Andreas Stieger 2015-10-19 12:58:47 UTC
CVE-2014-1829
=============

https://github.com/kennethreitz/requests/pull/1892
( f1893c835570d72823c970fbd6e0e42c13b1f0f2 )

with these changes:
7ba5a534ae9fc24e40b3ae6c480c9075d684727e
326a22e8880c1dba52698a479eb7b6038d5b2e87
d9f34c6848b9b313beefa7d3ce05f52fdea28c27



commit d9f34c6848b9b313beefa7d3ce05f52fdea28c27
Author: Cory Benfield <lukasaoz@gmail.com>
Date:   Fri Jan 31 07:36:44 2014 +0000

    Respect trust_env on redirect.

commit 326a22e8880c1dba52698a479eb7b6038d5b2e87
Author: Cory Benfield <lukasaoz@gmail.com>
Date:   Thu Jan 30 15:11:24 2014 +0000

    Better layout for checking.

commit 7ba5a534ae9fc24e40b3ae6c480c9075d684727e
Author: Cory Benfield <lukasaoz@gmail.com>
Date:   Wed Jan 29 19:13:46 2014 +0000

    Repopulate ~/.netrc auth.


The SUSE products which were affected are now out of support.
openSUSE 13.2 and up not affected.
The change merges to 1.2.3 and openSUSE 13.1 is affected.

CVE-2014-1830
=============

same versions.

Single:
https://github.com/kennethreitz/requests/commit/4d8cb3244e8e4f84b250c10a48e025f9a8bf6137
https://github.com/kennethreitz/requests/commit/4d8cb3244e8e4f84b250c10a48e025f9a8bf6137.patch

With more corrections:
https://github.com/kennethreitz/requests/commit/fe4c4f146124d7fba2e680581a5d6b9d98e3fdf8
https://github.com/kennethreitz/requests/commit/fe4c4f146124d7fba2e680581a5d6b9d98e3fdf8.patch
Comment 8 Bernhard Wiedemann 2016-01-21 15:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (897658) was mentioned in
https://build.opensuse.org/request/show/355260 13.1 / python-requests
Comment 9 Swamp Workflow Management 2016-01-26 13:11:34 UTC
openSUSE-SU-2016:0246-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 897658
CVE References: CVE-2014-1830
Sources used:
openSUSE 13.1 (src):    python-requests-1.2.3-4.3.1
Comment 10 Bernhard Wiedemann 2016-02-08 14:26:43 UTC
update is released