python3-requests: redirect can expose netrc password

Debian Bug report logs - #733108
python3-requests: redirect can expose netrc password

Toggle useless messages

Message #3 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jakub Wilk <jwilk@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: python3-requests: redirect can expose netrc password

Date: Wed, 25 Dec 2013 17:40:43 +0100

[Message part 1 (text/plain, inline)]

Package: python3-requests
Version: 2.0.0-1
Tags: security

If site A redirects to site B, and user had a password for site A in 
their ~/.netrc, then requests would send authorization information both 
to site A and to site B.

I've attached a netrc file and a pair of test scripts that should help 
reproducing the bug.

-- 
Jakub Wilk

[testhttpserver.py (text/x-python, attachment)]

[testhttpclient.py (text/x-python, attachment)]

[.netrc (text/plain, attachment)]

Message #8 received at 733108@bugs.debian.org (full text, mbox, reply):

From: Daniele Tricoli <eriol@mornie.org>

To: 733108@bugs.debian.org, control@bugs.debian.org

Subject: Re: python3-requests: redirect can expose netrc password

Date: Mon, 27 Jan 2014 18:17:27 +0100

forwarded 733108 https://github.com/kennethreitz/requests/issues/1885
tags 733108 confirmed
thanks

On Wednesday 25 December 2013 17:40:43 Jakub Wilk wrote:
> I've attached a netrc file and a pair of test scripts that should help 
> reproducing the bug.

Many thanks for the report! I forwarded it upstream.

Kind regards,

-- 
 Daniele Tricoli 'Eriol'
 http://mornie.org

Message #17 received at 733108-done@bugs.debian.org (full text, mbox, reply):

From: Jakub Wilk <jwilk@debian.org>

To: 733108-done@bugs.debian.org

Subject: Re: Bug#733108: python3-requests: redirect can expose netrc password

Date: Tue, 16 Sep 2014 23:50:56 +0200

Version: 2.3.0-1

It looks like the bug was fixed upstream in 2.3.0:

>- No longer expose Authorization or Proxy-Authorization headers on 
>redirect. Fix CVE-2014-1829 and CVE-2014-1830 respectively.

-- 
Jakub Wilk

Message #22 received at 733108@bugs.debian.org (full text, mbox, reply):

From: Daniele Tricoli <eriol@mornie.org>

To: 733108@bugs.debian.org

Subject: Re: Bug#733108: python3-requests: redirect can expose netrc password

Date: Wed, 17 Sep 2014 01:06:12 +0200

Hello Jakub,

On Tuesday 16 September 2014 23:50:56 Jakub Wilk wrote:
> Version: 2.3.0-1
> 
> It looks like the bug was fixed upstream in 2.3.0:

Thanks for taking care of closing this. I received the notification from 
github, but I will work on requests (I plan to update to 2.4.1) on the 
weekend.

To acknowledge the fix of this security bug, I should put something in the 
changelog anyway, right?
Something like this:
  * Acknowledge fix for CVE-2014-1829 and CVE-2014-1830 in 2.3.0-1
    (Closes: #733108)

Developer reference[¹] says: "When closing security bugs include CVE numbers 
as well as the Closes: #nnnnn. This is useful for the security team to track 
vulnerabilities. If an upload is made to fix the bug before the advisory ID is 
known, it is encouraged to modify the historical changelog entry with the next 
upload."

So using "Closes: #733108" although the bug is arleady closed seems ok to me, 
is that right?

Many thanks!

Kind regards,

[¹] https://www.debian.org/doc/manuals/developers-reference/pkgs.html#newpackage

-- 
 Daniele Tricoli 'Eriol'
 http://mornie.org

Message #25 received at 733108@bugs.debian.org (full text, mbox, reply):

From: Jakub Wilk <jwilk@debian.org>

To: 733108@bugs.debian.org

Subject: Re: Bug#733108: python3-requests: redirect can expose netrc password

Date: Fri, 19 Sep 2014 22:17:49 +0200

Hi Daniele!

[Bug submitters don't automatically receive BTS message copies. You need 
to CC them explicitly. I saw your message only by chance...]

* Daniele Tricoli <eriol@mornie.org>, 2014-09-17, 01:06:
>To acknowledge the fix of this security bug, I should put something in 
>the changelog anyway, right?
>Something like this:
>  * Acknowledge fix for CVE-2014-1829 and CVE-2014-1830 in 2.3.0-1
>    (Closes: #733108)
>
>Developer reference[¹] says: "When closing security bugs include CVE 
>numbers as well as the Closes: #nnnnn. This is useful for the security 
>team to track vulnerabilities. If an upload is made to fix the bug 
>before the advisory ID is known, it is encouraged to modify the 
>historical changelog entry with the next upload."

As the DevRef suggests, you should retroactively add the CVE reference 
to the changelog entry for 2.3.0-1, so don't mention "in 2.3.0-1".

>So using "Closes: #733108" although the bug is arleady closed seems ok 
>to me, is that right?

Yup, that should be fine.

-- 
Jakub Wilk

Send a report that this bug log contains spam.