CVE-2023-32681 (Medium) detected in requests-2.26.0-py2.py3-none-any.whl - autoclosed

[mend-for-github.aaakk.us.kg]

CVE-2023-32681 - Medium Severity Vulnerability

Vulnerable Library - requests-2.26.0-py2.py3-none-any.whl

Python HTTP for Humans.

Library home page: https://files.pythonhosted.org/packages/92/96/144f70b972a9c0eabbd4391ef93ccd49d0f2747f4f6a2a2738e99e5adc65/requests-2.26.0-py2.py3-none-any.whl

Path to dependency file: /benchmarks/perf-tool/requirements.txt

Path to vulnerable library: /benchmarks/perf-tool/requirements.txt

Dependency Hierarchy:

• ❌ requests-2.26.0-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 80c7532a3b210526d674201b51bb7b1b47593946

Found in base branch: main

Vulnerability Details

Unintended leak of Proxy-Authorization header in requests from 2.3.0 before 2.31.0. Requests has been vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. For HTTP connections sent through the proxy, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the Proxy-Authorization header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.

Publish Date: 2023-05-11

URL: CVE-2023-32681

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j8r2-6x86-q33q

Release Date: 2023-05-11

Fix Resolution: requests -2.31.0

---

• Check this box to open an automated fix PR

[mend-for-github.aaakk.us.kg]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.