Proxy Credential Leakage in Requests Package: CVE-2023-32681
Summary
DEBIAN-CVE-2023-32681: Requests is a HTTP library. Affects requests versions < 2.31.0+dfsg-1. Fixed in 2.31.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Requests package is a widely used HTTP library in Python, designed to simplify making HTTP requests. It provides a user-friendly interface for sending HTTP/1.1 requests, handling sessions, and managing cookies. However, a vulnerability has been identified that allows Proxy-Authorization headers to be unintentionally leaked to destination servers during HTTPS redirections.
Vulnerability Detail
Since version 2.3.0, the Requests library has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This occurs due to the way the library handles proxy connections. When a request is sent through a proxy, the Proxy-Authorization header must be included in the CONNECT request. If the request is redirected to an HTTPS endpoint, the header is forwarded to the destination server, potentially exposing sensitive proxy credentials to malicious actors.
How To Fix
Minimum fixed version
2.31.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade requestsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of proxy servers when making requests to HTTPS endpoints until the package is updated. Alternatively, you can manually remove the Proxy-Authorization header from requests if you have control over the request construction.
Conclusion
The vulnerability CVE-2023-32681 in the Requests package poses a significant risk by leaking sensitive proxy credentials to destination servers during HTTPS redirections. It is crucial to update to the patched version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for requests →
FAQ
CVE-2023-32681 is a vulnerability in the Requests package that allows Proxy-Authorization headers to be leaked to destination servers during HTTPS redirections.
If your application uses the Requests library and makes HTTPS requests through a proxy, sensitive proxy credentials may be exposed to external servers.
The vulnerability affects all versions of Requests starting from 2.3.0 up to, but not including, 2.31.0+dfsg-1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update the Requests package right away, consider avoiding the use of proxy servers for HTTPS requests or manually removing the Proxy-Authorization header from your requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for requests.
