Stay Secure with the Latest Linux Advisories

security advisoryauthentication issuelow severity

Mageia 9: MGASA-2024-0347 low severity: urllib3 Proxy-Authorization issue

When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the Proxy-Authorization . MGASA-2024-0347 - Updated python-urllib3 packages fix security vulnerability Publication date: 08 Nov 2024 URL: https://advisories.mageia.org/MGASA-2024-0347.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-37891 When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the Proxy-Authorization header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the Proxy-Authorization HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the Proxy-Authorization header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the Proxy-Authorization header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. References: - https://bugs.mageia.org/show_bug.cgi?id=33716 - https://www.cve.org/CVERecord?id=CVE-2024-37891 SRPMS: - 9/core/python-urllib3-1.26.20-1.mga9 . The latest python-urllib3 updates tackle a minor security concern associated with the utilization of Proxy-Authorization. Discover more details.. mageia security, python urllib3, proxy manager, HTTP headers. . Severity: Low. LinuxSecurity.com Team

Nov 08, 2024 •Low Mageia