CVE-2021-3116: Proxy-py - Incorrect Proxy-Authorization Header Data
Summary
CVE-2021-3116: before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or). Affects proxy-py versions < 2.3.1. Fixed in 2.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Proxy-py is a Python package available on PyPI that provides a proxy server implementation. It allows users to create and manage proxy servers for various purposes. The package is widely used in Python applications that require proxy functionality. However, a vulnerability has been discovered in versions prior to 2.3.1 that can lead to incorrect handling of the Proxy-Authorization header data.
Vulnerability Detail
The vulnerability exists in the before_upstream_connection function of the AuthPlugin class in the http/proxy/auth.py module of proxy.py. Due to a boolean confusion (and versus or), the function accepts incorrect Proxy-Authorization header data. This can potentially allow unauthorized access to the proxy server or result in other security issues. The vulnerability was assigned CVE-2021-3116 and has been documented in the PYSEC-2021-46 advisory.
How To Fix
Minimum fixed version
2.3.1
This is the first release that contains the fix.
pip install --upgrade "proxy-py==2.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users who are unable to immediately upgrade to the fixed version can consider implementing additional security measures, such as restricting access to the proxy server or implementing other access control mechanisms.
Conclusion
The vulnerability in proxy-py versions prior to 2.3.1 allows incorrect handling of the Proxy-Authorization header data, potentially leading to unauthorized access or other security issues. It is recommended to upgrade to the fixed version or apply additional security measures. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for proxy-py →
FAQ
The vulnerability can potentially allow unauthorized access to the proxy server or result in other security issues.
Versions prior to 2.3.1 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock file and provides real-time alerts for open-source vulnerabilities.
Yes, upgrading to version 2.3.1 or later of the proxy-py package fixes this vulnerability.
There are no known exploits for this vulnerability at the time of writing. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
