Bug 1222886 (CVE-2024-3574)

Summary:	VUL-0: CVE-2024-3574: python-Scrapy: Authorization header leakage on cross-domain redirect
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Dirk Mueller <dmueller>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	camila.matos, rfrohl
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/401987/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-16 09:31:36 UTC

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-3574
https://www.cve.org/CVERecord?id=CVE-2024-3574
https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75
https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9
https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv

Comment 1 Robert Frohl 2024-04-16 09:32:41 UTC

already fixed, only missing reference. Closing