ALAS2-2019-1334


Amazon Linux 2 Security Advisory: ALAS-2019-1334
Advisory Release Date: 2019-10-21 18:01 Pacific
Advisory Updated Date: 2019-10-23 23:59 Pacific
Severity: Low

Issue Overview:

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials.(CVE-2018-18074)


Affected Packages:

python-requests


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update python-requests to update your system.

New Packages:
noarch:
    python-requests-2.6.0-7.amzn2.noarch

src:
    python-requests-2.6.0-7.amzn2.src