Unintended leak of Proxy-Authorization header in requests
Priority LOW 33CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 10 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02974 87th percentileScored 2026-11-07
Fix Partial requests (psf): 2.31.0requests (PyPI): 2.31.0Red Hat: 9 advisoriesRed Hat: 10 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| python-pillow | requests | 2.3.0 to before 2.31.0 | 2.31.0 | Patch available | CNA |
| — | requests (PyPI) | 2.3.0 to before 2.31.0 | 2.31.0 | Patch available | GHSA-j8r2-6x86-q33q |
- requests Vendorpython-pillow Affected 2.3.0 to before 2.31.0 Fixed in 2.31.0 Patch available CNA
- requests (PyPI) Vendor— Affected 2.3.0 to before 2.31.0 Fixed in 2.31.0 Patch available GHSA-j8r2-6x86-q33q
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:requests:*:*:*:*:*:*:*:* | 2.3.0 to before 2.31.0 | Vulnerable | python-pillow |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:python:requests:*:*:*:*:*:*:*:* Versions 2.3.0 to before 2.31.0 Vulnerable ·python-pillow
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA requests (psf) Fixed in 2.31.0
- Fix · GHSA-j8r2-6x86-q33q requests (PyPI) Fixed in 2.31.0 Advisory →
Red Hat 9 advisories
- RHSA-2024:0299 Released 2024-01-18 · Red Hat rating Moderatepython-requests security update
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) python-requests-2.20.0-3.el8_6, python3-requests-2.20.0-3.el8_6
- RHSA-2023:7034 Released 2023-11-14 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat CodeReady Linux Builder (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.9.0+19644+d68f775d.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
- RHSA-2023:7050 Released 2023-11-14 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat CodeReady Linux Builder (v. 8) pytest-4.6.6-3.module+el8.9.0+19592+4b459c9b.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.9.0+19592+4b459c9b.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.9.0+19592+4b459c9b.src::python38-devel:3.8 +15
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.9.0+19598+4a60c7b7.src::python38:3.8, PyYAML-5.4.1-1.module+el8.9.0+19598+4a60c7b7.src::python38:3.8, babel-2.7.0-11.module+el8.9.0+19598+4a60c7b7.src::python38:3.8 +47
Show 6 more Red Hat advisories
- RHSA-2023:7042 Released 2023-11-14 · Red Hat rating Moderatepython27:2.7 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.9.0+19487+7dc18407.src::python27:2.7, PyYAML-3.12-16.module+el8.9.0+19487+7dc18407.src::python27:2.7, babel-2.5.1-10.module+el8.9.0+19487+7dc18407.noarch::python27:2.7 +47
- RHSA-2023:6818 Released 2023-11-08 · Red Hat rating ImportantSatellite 6.14 security and bug fix update
- Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
- RHSA-2023:6793 Released 2023-11-08 · Red Hat rating Importantrh-python38-python security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python-3.8.18-2.el7, rh-python38-python-cryptography-2.8-6.el7, rh-python38-python-debug-3.8.18-2.el7 +14
- Red Hat Software Collections for RHEL(v. 7) rh-python38-python-3.8.18-2.el7, rh-python38-python-cryptography-2.8-6.el7, rh-python38-python-debug-3.8.18-2.el7 +14
- RHSA-2023:4693 Released 2023-08-21 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-eda-controller-1.0.1-1.el8ap, automation-eda-controller-server-1.0.1-1.el8ap, automation-eda-controller-ui-1.0.1-1.el8ap +6
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-eda-controller-1.0.1-1.el9ap, automation-eda-controller-server-1.0.1-1.el9ap, automation-eda-controller-ui-1.0.1-1.el9ap +4
- RHSA-2023:4520 Released 2023-08-08 · Red Hat rating Moderatepython-requests security update
- Red Hat Enterprise Linux BaseOS (v. 8) python-requests-2.20.0-3.el8_8, python3-requests-2.20.0-3.el8_8
- RHSA-2023:4350 Released 2023-08-01 · Red Hat rating Moderatepython-requests security update
- Red Hat Enterprise Linux AppStream (v. 9) python3-requests+security-2.25.1-7.el9_2, python3-requests+socks-2.25.1-7.el9_2
- Red Hat Enterprise Linux BaseOS (v. 9) python-requests-2.25.1-7.el9_2, python3-requests-2.25.1-7.el9_2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat Update Infrastructure 4 for Cloud Providers | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2023:4693 |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2023:7034, RHSA-2023:7050 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:7034, RHSA-2023:7042, RHSA-2023:7050 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:4350 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:4520 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:4350 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:0299 |
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2023:6818 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2023:6793 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2023:6793 |
Not affected: 5 products
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Satellite 6.14 for RHEL 8
- Red Hat Software Collections for RHEL Workstation(v. 7)
- Red Hat Software Collections for RHEL(v. 7)
Timeline
- 2026-10-02 Threatist record created from CVE-2023-32681
- 2026-10-03 Alias added: GHSA-j8r2-6x86-q33q
References
Advisory 3
Other 8
- https://github.com/psf/requests/releases/tag/v2.31.0
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/
- https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html
- https://security.gentoo.org/glsa/202309-08
- https://github.com/psf/requests
- https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2023-74.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ
More python-pillow Requests vulnerabilities
- TI-2018-12846 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an… CVSS 3.1HIGH 7.5
- TI-2015-02029 The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows… CVSS 2.0MEDIUM 6.8
- TI-2014-01432 Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive… CVSS 2.0MEDIUM 5.0
- TI-2014-01431 Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc… CVSS 2.0MEDIUM 5.0
- TI-2026-20745 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function CVSS 3.1MEDIUM 5.5
Sources
- CVE-2023-32681 · CVE Program
- CVE-2023-32681 · NVD
- FIRST EPSS
- GHSA-j8r2-6x86-q33q · GitHub Advisory Database · CC BY 4.0
- CVE-2023-32681 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences