svn commit: r490936 - head/security/vuxml

Tue Jan 22 10:44:40 UTC 2019

Author: koobs
Date: Tue Jan 22 10:44:39 2019
New Revision: 490936
URL: https://svnweb.freebsd.org/changeset/ports/490936

Log:
  security/vuxml: Add www/py-requests: Information disclosure vulnerability

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Tue Jan 22 10:24:51 2019	(r490935)
+++ head/security/vuxml/vuln.xml	Tue Jan 22 10:44:39 2019	(r490936)
@@ -58,6 +58,36 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="50ad9a9a-1e28-11e9-98d7-0050562a4d7b">
+    <topic>www/py-requests -- Information disclosure vulnerability</topic>
+    <affects>
+      <package>
+	<name>py*-requests</name>
+	<range><lt>2.20.0</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074">
+	  <p>The Requests package before 2.20.0 for Python sends an HTTP Authorization header
+	     to an http URI upon receiving a same-hostname https-to-http redirect, which makes
+	     it easier for remote attackers to discover credentials by sniffing the network.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074</url>
+      <url>https://nvd.nist.gov/vuln/detail/CVE-2018-18074</url>
+      <url>https://github.com/requests/requests/issues/4716</url>
+      <url>https://github.com/requests/requests/pull/4718</url>
+      <url>https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff</url>
+    </references>
+    <dates>
+      <discovery>2018-06-27</discovery>
+      <entry>2019-01-22</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="6aa398d0-1c4d-11e9-96dd-a4badb296695">
     <topic>joomla3 -- vulnerabilitiesw</topic>
     <affects>
