drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in Requests
Name: |
Zwei Probleme in Requests |
|
ID: |
DSA-3146-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian wheezy |
|
Datum: |
Fr, 30. Januar 2015, 19:54 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1829
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1830 |
|
Applikationen: |
Requests |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
- ------------------------------------------------------------------------- Debian Security Advisory DSA-3146-1 security@debian.org http://www.debian.org/security/ Sebastien Delafond January 30, 2015 http://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : requests CVE ID : CVE-2014-1829 CVE-2014-1830 Debian Bug : 733108
Jakub Wilk discovered that in requests, an HTTP library for the Python language, authentication information was improperly handled when a redirect occured. This would allow remote servers to obtain two different types of sensitive information: proxy passwords from the Proxy-Authorization header (CVE-2014-1830), or netrc passwords from the Authorization header (CVE-2014-1829).
For the stable distribution (wheezy), this problem has been fixed in version 0.12.1-1+deb7u1.
For the upcoming stable distribution (jessie) and unstable distribution (sid), this problem has been fixed in version 2.3.0-1.
We recommend that you upgrade your requests packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v2
iQEcBAEBCAAGBQJUy49eAAoJEBC+iYPz1Z1k9NkH/0gfqT+iVAg7eEUv45Cq+2eC GhqAK4kWssYQQ9TxjUm2jC+5ACMzqP5wNTCu9LZHeAYv08MXd+D+kcmCgyUKpd6T TE12DbO8fdW9Kos6al4vukxmDCOemXYmX2XDzzCw2hUk1g3Qummh7lB2M2vjs7o3 IcRo05HLh97qbulduPD0lmsU8na4NNPItTQMqtBn6uCp35AANTxNyDlzxxl3qKhq WoCzVFWU+S0Z44k2laqp8yxOlNnTGoMH3inQL74T5jIhWGNNKntFZJf4HD252OH3 snoscPYNVldRteJ2uyzxOY95x0ybn46fvTk76Mno9tVoxjfDq9UWTb/Xt3+lFDo= =0AoF -----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org Archive: https://lists.debian.org/E1YHDti-0005RM-LL@pool.mine.nu
|
|
|
|