Summary
Dennis Brinkrolf and Tobias Funke discovered that Requests did not
correctly handle certain HTTP headers. A remote attacker could possibly
use this issue to leak sensitive information. This issue only affected
Ubuntu 14.04 LTS. (CVE-2023-32681)
Juho Forsén discovered that Requests did not correctly parse URLs. A
remote attacker could possibly use this issue to leak sensitive
information. (CVE-2024-47081)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | requests | 2.25.1+dfsg-2ubuntu0.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | requests | 2.31.0+dfsg-1ubuntu1.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | requests | 2.2.1-1ubuntu0.4+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | requests | 2.9.1-3ubuntu0.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | requests | 2.18.4-2ubuntu0.1+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | requests | 2.22.0-2ubuntu1.1+esm1 |
Vulnerabilities 2
-
Medium 6.1CVE-2023-32681 Public exploit
Unintended leak of Proxy-Authorization header in requests
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header…
-
Medium 5.3
Requests vulnerable to .netrc credentials leak via malicious URLs
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Reques…