Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Zwei Probleme in Requests
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in Requests
ID: DSA-3146-1
Distribution: Debian
Plattformen: Debian wheezy
Datum: Fr, 30. Januar 2015, 19:54
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1829
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1830

Originalnachricht

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3146-1 security@debian.org
http://www.debian.org/security/ Sebastien Delafond
January 30, 2015 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : requests
CVE ID : CVE-2014-1829 CVE-2014-1830
Debian Bug : 733108

Jakub Wilk discovered that in requests, an HTTP library for the Python
language, authentication information was improperly handled when a
redirect occured. This would allow remote servers to obtain two
different types of sensitive information: proxy passwords from the
Proxy-Authorization header (CVE-2014-1830), or netrc passwords from
the Authorization header (CVE-2014-1829).

For the stable distribution (wheezy), this problem has been fixed in
version 0.12.1-1+deb7u1.

For the upcoming stable distribution (jessie) and unstable
distribution (sid), this problem has been fixed in version 2.3.0-1.

We recommend that you upgrade your requests packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJUy49eAAoJEBC+iYPz1Z1k9NkH/0gfqT+iVAg7eEUv45Cq+2eC
GhqAK4kWssYQQ9TxjUm2jC+5ACMzqP5wNTCu9LZHeAYv08MXd+D+kcmCgyUKpd6T
TE12DbO8fdW9Kos6al4vukxmDCOemXYmX2XDzzCw2hUk1g3Qummh7lB2M2vjs7o3
IcRo05HLh97qbulduPD0lmsU8na4NNPItTQMqtBn6uCp35AANTxNyDlzxxl3qKhq
WoCzVFWU+S0Z44k2laqp8yxOlNnTGoMH3inQL74T5jIhWGNNKntFZJf4HD252OH3
snoscPYNVldRteJ2uyzxOY95x0ybn46fvTk76Mno9tVoxjfDq9UWTb/Xt3+lFDo=
=0AoF
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org
Archive: https://lists.debian.org/E1YHDti-0005RM-LL@pool.mine.nu
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung