diff -Nru requests-2.18.4/debian/changelog requests-2.18.4/debian/changelog --- requests-2.18.4/debian/changelog 2018-02-09 18:31:10.000000000 +0000 +++ requests-2.18.4/debian/changelog 2018-10-11 14:45:55.000000000 +0000 @@ -1,3 +1,12 @@ +requests (2.18.4-2ubuntu0.1) bionic-security; urgency=medium + + * SECURITY UPDATE: Creadentials through HTTP Authorization header + - debian/patches/CVE-2018-18074.patch: fix in requests/sessions.py, + test_requests.py. + - CVE-2018-18074 + + -- Leonidas S. Barbosa Thu, 11 Oct 2018 11:45:55 -0300 + requests (2.18.4-2) unstable; urgency=medium * debian/control diff -Nru requests-2.18.4/debian/control requests-2.18.4/debian/control --- requests-2.18.4/debian/control 2018-02-09 18:31:10.000000000 +0000 +++ requests-2.18.4/debian/control 2018-10-11 14:45:55.000000000 +0000 @@ -1,5 +1,6 @@ Source: requests -Maintainer: Debian Python Modules Team +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Debian Python Modules Team Uploaders: Daniele Tricoli Section: python Priority: optional diff -Nru requests-2.18.4/debian/patches/CVE-2018-18074.patch requests-2.18.4/debian/patches/CVE-2018-18074.patch --- requests-2.18.4/debian/patches/CVE-2018-18074.patch 1970-01-01 00:00:00.000000000 +0000 +++ requests-2.18.4/debian/patches/CVE-2018-18074.patch 2018-10-11 14:45:33.000000000 +0000 @@ -0,0 +1,112 @@ +From 3331e2aecdbf575dd60abef4df79c52d78610a83 Mon Sep 17 00:00:00 2001 +From: Bruce Merry +Date: Thu, 28 Jun 2018 16:38:42 +0200 +Subject: [PATCH 1/2] Strip Authorization header whenever root URL changes + +Previously the header was stripped only if the hostname changed, but in +an https -> http redirect that can leak the credentials on the wire +(#4716). Based on with RFC 7235 section 2.2, the header is now stripped +if the "canonical root URL" (scheme+authority) has changed, by checking +scheme, hostname and port. +--- + requests/sessions.py | 4 +++- + tests/test_requests.py | 12 +++++++++++- + 2 files changed, 14 insertions(+), 2 deletions(-) + +Index: requests-2.18.4/requests/sessions.py +=================================================================== +--- requests-2.18.4.orig/requests/sessions.py ++++ requests-2.18.4/requests/sessions.py +@@ -116,6 +116,22 @@ class SessionRedirectMixin(object): + return to_native_string(location, 'utf8') + return None + ++ def should_strip_auth(self, old_url, new_url): ++ """Decide whether Authorization header should be removed when redirecting""" ++ old_parsed = urlparse(old_url) ++ new_parsed = urlparse(new_url) ++ if old_parsed.hostname != new_parsed.hostname: ++ return True ++ # Special case: allow http -> https redirect when using the standard ++ # ports. This isn't specified by RFC 7235, but is kept to avoid ++ # breaking backwards compatibility with older versions of requests ++ # that allowed any redirects on the same host. ++ if (old_parsed.scheme == 'http' and old_parsed.port in (80, None) ++ and new_parsed.scheme == 'https' and new_parsed.port in (443, None)): ++ return False ++ # Standard case: root URI must match ++ return old_parsed.port != new_parsed.port or old_parsed.scheme != new_parsed.scheme ++ + def resolve_redirects(self, resp, req, stream=False, timeout=None, + verify=True, cert=None, proxies=None, yield_requests=False, **adapter_kwargs): + """Receives a Response. Returns a generator of Responses or Requests.""" +@@ -232,14 +248,10 @@ class SessionRedirectMixin(object): + headers = prepared_request.headers + url = prepared_request.url + +- if 'Authorization' in headers: ++ if 'Authorization' in headers and self.should_strip_auth(response.request.url, url): + # If we get redirected to a new host, we should strip out any + # authentication headers. +- original_parsed = urlparse(response.request.url) +- redirect_parsed = urlparse(url) +- +- if (original_parsed.hostname != redirect_parsed.hostname): +- del headers['Authorization'] ++ del headers['Authorization'] + + # .netrc might have more auth for us on our new host. + new_auth = get_netrc_auth(url) if self.trust_env else None +Index: requests-2.18.4/tests/test_requests.py +=================================================================== +--- requests-2.18.4.orig/tests/test_requests.py ++++ requests-2.18.4/tests/test_requests.py +@@ -1480,15 +1480,15 @@ class TestRequests: + preq = req.prepare() + assert test_url == preq.url + +- @pytest.mark.xfail(raises=ConnectionError) +- def test_auth_is_stripped_on_redirect_off_host(self, httpbin): ++ def test_auth_is_stripped_on_http_downgrade(self, httpbin, httpbin_secure, httpbin_ca_bundle): + r = requests.get( +- httpbin('redirect-to'), +- params={'url': 'http://www.google.co.uk'}, ++ httpbin_secure('redirect-to'), ++ params={'url': httpbin('get')}, + auth=('user', 'pass'), ++ verify=httpbin_ca_bundle + ) + assert r.history[0].request.headers['Authorization'] +- assert not r.request.headers.get('Authorization', '') ++ assert 'Authorization' not in r.request.headers + + def test_auth_is_retained_for_redirect_on_host(self, httpbin): + r = requests.get(httpbin('redirect/1'), auth=('user', 'pass')) +@@ -1497,6 +1497,27 @@ class TestRequests: + + assert h1 == h2 + ++ def test_should_strip_auth_host_change(self): ++ s = requests.Session() ++ assert s.should_strip_auth('http://example.com/foo', 'http://another.example.com/') ++ ++ def test_should_strip_auth_http_downgrade(self): ++ s = requests.Session() ++ assert s.should_strip_auth('https://example.com/foo', 'http://example.com/bar') ++ ++ def test_should_strip_auth_https_upgrade(self): ++ s = requests.Session() ++ assert not s.should_strip_auth('http://example.com/foo', 'https://example.com/bar') ++ assert not s.should_strip_auth('http://example.com:80/foo', 'https://example.com/bar') ++ assert not s.should_strip_auth('http://example.com/foo', 'https://example.com:443/bar') ++ # Non-standard ports should trigger stripping ++ assert s.should_strip_auth('http://example.com:8080/foo', 'https://example.com/bar') ++ assert s.should_strip_auth('http://example.com/foo', 'https://example.com:8443/bar') ++ ++ def test_should_strip_auth_port_change(self): ++ s = requests.Session() ++ assert s.should_strip_auth('http://example.com:1234/foo', 'https://example.com:4321/bar') ++ + def test_manual_redirect_with_partial_body_read(self, httpbin): + s = requests.Session() + r1 = s.get(httpbin('redirect/2'), allow_redirects=False, stream=True) diff -Nru requests-2.18.4/debian/patches/series requests-2.18.4/debian/patches/series --- requests-2.18.4/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ requests-2.18.4/debian/patches/series 2018-10-11 14:45:49.000000000 +0000 @@ -0,0 +1 @@ +CVE-2018-18074.patch