UBUNTU-CVE-2024-1968

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2024-1968
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-1968.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-1968
Related
Published
2024-05-20T08:15:00Z
Modified
2024-10-15T14:12:49Z
Summary
[none]
Details

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the buildredirect_request function of the redirect middleware.

References

Affected packages

Ubuntu:Pro:16.04:LTS / python-scrapy

Package

Name
python-scrapy
Purl
pkg:deb/ubuntu/python-scrapy?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0-1
1.0.3-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / python-scrapy

Package

Name
python-scrapy
Purl
pkg:deb/ubuntu/python-scrapy?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.0-1~exp2
1.4.0-1
1.5.0-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / python-scrapy

Package

Name
python-scrapy
Purl
pkg:deb/ubuntu/python-scrapy?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.7.3-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / python-scrapy

Package

Name
python-scrapy
Purl
pkg:deb/ubuntu/python-scrapy?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.4.1-2
2.5.1-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / python-scrapy

Package

Name
python-scrapy
Purl
pkg:deb/ubuntu/python-scrapy?arch=src?distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.11.1-1
2.11.2-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / python-scrapy

Package

Name
python-scrapy
Purl
pkg:deb/ubuntu/python-scrapy?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.10.0-1
2.11.0-1
2.11.0-2
2.11.1-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}