Viktor Szakats reported that libcurl, an URL transfer library, does not strip off user credentials from the URL when automatically populating the Referer HTTP request header field in outgoing HTTP requests. Sensitive authentication data may leak to the server that is . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2664-1
Requests could be made to expose authentication credentials over the network.. =========================================================================Ubuntu Security Notice USN-2382-1 October 14, 2014 requests vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: Requests could be made to expose authentication credentials over the network. Software Description: - requests: elegant and simple HTTP library for Python Details: Jakub Wilk discovered that Requests incorrectly reused authentication credentials after being redirected. An attacker could possibly use this issue to obtain authentication credentials intended for another site. (CVE-2014-1829, CVE-2014-1830) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: python-requests 2.2.1-1ubuntu0.1 python3-requests 2.2.1-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2382-1 CVE-2014-1829, CVE-2014-1830 Package Information: https://launchpad.net/ubuntu/+source/requests/2.2.1-1ubuntu0.1 . Potential security flaws in Ubuntu 14.04 may leak authentication tokens across the network. It is advisable to upgrade for enhanced safety.. requests library, Ubuntu 14.04, authentication risks, security patch. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.