Description
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | httpcomponents-client | 4.1.1-1 | — |
| Debian 13 | httpcomponents-client | 4.1.1-1 | — |
| Debian 12 | httpcomponents-client | 4.1.1-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.httpcomponents:httpclient | >= 4.0.0, < 4.1.1 | 4.1.1 | GHSA-gw85-4gmf-m7rh |
References
- [httpclient-users] 20110224 Proxy-Authorization header received on server side mailing-list
- [oss-security] 20110408 Re: Apache HttpClient CVE request [VU#153049] mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=709531
- [httpclient-users] 20110224 Re: Proxy-Authorization header received on server side mailing-list
- [httpclient-users] 20110224 RE: Proxy-Authorization header received on server side mailing-list
- [oss-security] 20110407 Apache HttpClient CVE request [VU#153049] mailing-list
- https://issues.apache.org/jira/browse/HTTPCLIENT-1061
- VU#153049 third-party-advisory
- 46974 vdb-entry
- [httpclient-users] 20110224 Re: Proxy-Authorization header received on server side mailing-list
- 8298 third-party-advisory
- FEDORA-2011-7747 vendor-advisory
- [httpclient-users] 20110224 RE: Proxy-Authorization header received on server side mailing-list
- http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1.x.txt