ubuntu.com
Open in
urlscan Pro
2620:2d:4000:1::28
Public Scan
URL:
https://ubuntu.com/security/CVE-2023-32681
Submission: On July 19 via api from US — Scanned from GB
Submission: On July 19 via api from US — Scanned from GB
Form analysis
1 forms found in the DOM/search
<form action="/search" class="p-search-box is-light">
<input type="search" class="p-search-box__input" name="q" placeholder="Search our sites" required="" aria-label="Search our sites">
<button type="reset" class="p-search-box__reset">
<i class="p-icon--close"></i>
</button>
<button type="submit" class="p-search-box__button">
<i class="p-icon--search"></i>
</button>
</form>
Text Content
Skip to main content Canonical Ubuntu * * Menu * Products * Use cases * Support * Community * Get Ubuntu * All Canonical * Back * Products * Back * Canonical * Ubuntu * Ubuntu Pro * Snapcraft * LXD * MAAS * OpenStack * Ceph * Kubernetes * Juju * Also from Canonical * Back * Anbox Cloud * Launchpad * Ubuntu on public clouds * Multipass * Cloud-init * Landscape * Netplan * Charmed Kubeflow * MicroCloud * About * Back * Canonical * Press centre * Careers * Blog * Documentation * Resources * Partners * Contact us * Sign in * * Canonical Get to know Canonical, the company behind the products. * Ubuntu The world's favourite Linux OS for servers, desktops and IoT. * Ubuntu Pro One subscription for security maintenance, support, FIPS and other compliance certifications. * Snapcraft The app store for Linux: secure packages and ultra-reliable updates. * LXD A pure-container hypervisor. Run system containers and VMs at scale. * MAAS Build a bare metal cloud with super fast server provisioning. * OpenStack Upgrades, maintenance, support, and fully managed options for long-term, low-cost infra. * Ceph Software-defined storage that lowers your total cost of ownership. * Kubernetes App portability for K8s on VMware, Amazon, Azure, Google, Oracle, IBM and bare metal. * Juju Deploy, integrate and manage applications at any scale, on any infrastructure. -------------------------------------------------------------------------------- Also from Canonical Anbox Cloud Stream Android applications to any device. Launchpad The software collaboration platform behind Ubuntu. Ubuntu on public clouds Optimised Ubuntu for public clouds. Multipass Spin up Ubuntu VMs on Windows, Mac and Linux. Cloud-init Control and customise your cloud instances. Landscape Systems management and security patching for Ubuntu. Netplan Simplify and standardise complex network configuration. Charmed Kubeflow AI and MLOps at any scale, on any cloud. MicroCloud Deploy a fully functional cloud in minutes. -------------------------------------------------------------------------------- About * Canonical * Press centre * Careers * Blog * Documentation * Resources * Partners * Contact us Security * ESM * Livepatch * Certifications & Hardening * CVEs * Notices * Docker Images Your submission was sent successfully! Close You have successfully unsubscribed! Close Thank you for signing up for our newsletter! In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close CVE-2023-32681 Published: 26 May 2023 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0. NOTES AuthorNote mdeslaur On focal and earlier, the python-pip package bundles requests binaries when built. After updating requests, a no-change rebuild of python-pip is required. On jammy and later, requests is bundled in the python-pip package and needs to be patched. PRIORITY Medium CVSS 3 SEVERITY SCORE 6.1 Score breakdown STATUS Package Release Status python-pip Launchpad, Ubuntu, Debian bionic Needs triage focal Released (20.0.2-5ubuntu1.9) jammy Needed kinetic Ignored (end of life, was needs-triage) lunar Ignored (end of life, was needed) mantic Not vulnerable (23.2+dfsg-1) noble Not vulnerable (23.2+dfsg-1) trusty Needs triage upstream Needs triage xenial Needs triage requests Launchpad, Ubuntu, Debian bionic Released (2.18.4-2ubuntu0.1+esm1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only) focal Released (2.22.0-2ubuntu1.1) jammy Released (2.25.1+dfsg-2ubuntu0.1) kinetic Released (2.27.1+dfsg-1ubuntu2.1) lunar Released (2.28.1+dfsg-1ubuntu1.1) mantic Released (2.28.1+dfsg-1ubuntu2) noble Released (2.28.1+dfsg-1ubuntu2) trusty Needs triage upstream Released (2.31.0) xenial Released (2.9.1-3ubuntu0.1+esm1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only) Patches: upstream: https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 SEVERITY SCORE BREAKDOWN Parameter Value Base score 6.1 Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Changed Confidentiality High Integrity impact None Availability impact None Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N REFERENCES * https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q * https://ubuntu.com/security/notices/USN-6155-1 * https://ubuntu.com/security/notices/USN-6155-2 * https://www.cve.org/CVERecord?id=CVE-2023-32681 * NVD * Launchpad * Debian BUGS * http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036693 * https://bugs.launchpad.net/ubuntu/+source/python-pip/+bug/2031880 JOIN THE DISCUSSION * Ubuntu security updates mailing list * Security announcements mailing list CANONICAL IS OFFERING EXPANDED SECURITY MAINTENANCE Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages. Find out more about ESM › FURTHER READING * What you need to know about regreSSHion: an OpenSSH server remote code execution vulnerability (CVE-2024-6387) * An overview of machine learning security risks * What’s new in security for Ubuntu 24.04 LTS? * Canonical at America Digital Congress in Chile * Canonical’s showcase at HPE Tech Jam 2024 Back to top * CANONICAL OPENSTACK CANONICAL OPENSTACK * What is OpenStack * Features * Managed * Consulting * Install * Support * CANONICAL CEPH CANONICAL CEPH * What is Ceph * Managed * Consulting * Docs * Install * MANAGED MANAGED * OpenStack * Kubernetes * Ceph * Apps * Observability * Firefighting * CANONICAL KUBERNETES CANONICAL KUBERNETES * What is Kubernetes * Charmed Kubernetes * Managed * Install * Docs * Resources * AI / ML AI / ML * MLOps * Kubeflow * MLflow * Consulting * ROBOTICS ROBOTICS * ROS ESM * What is ROS * Community * Docs * CLOUD CLOUD * What is cloud computing * What is private cloud * What is hybrid cloud * What is multi-cloud * Public cloud * IOT IOT * App store * Embedded Linux * Management * UBUNTU CORE UBUNTU CORE * Features * Success stories * Services * Docs * UBUNTU DESKTOP UBUNTU DESKTOP * Organisations * Developers * Flavours * WSL * UBUNTU SERVER UBUNTU SERVER * Hyperscale * Docs * SECURITY SECURITY * ESM * Livepatch * Certifications & Hardening * CVEs * Notices * Docker Images * DOWNLOADS DOWNLOADS * Desktop * Server * Core * Cloud * OBSERVABILITY OBSERVABILITY * What is observability * Managed * APPLIANCE APPLIANCE * About * Portfolio * Community * Hardware * Virtual machines * SUPPORT SUPPORT * Your subscriptions * Account users * Pricing * Discourse * PRICING PRICING * Consulting * Desktops * Devices * SECTORS * Automotive * Industrial * Government * Telco * Finance * * Containers * Tutorials * 16-04 * Software partnerships * Landscape * Canonical Embedding Programme -------------------------------------------------------------------------------- * Contact us * Contact us * About us * Community * Careers * Blog * Resources * Press centre © 2024 Canonical Ltd. Ubuntu and Canonical are registered trademarks of Canonical Ltd. * Legal information * Data privacy * Manage your tracker settings * Report a bug on this site * * * * * Go to the top of the page YOUR TRACKER SETTINGS We use cookies and similar methods to recognise visitors and remember preferences. We also use them to measure campaign effectiveness and analyse site traffic. By selecting ‘Accept‘, you consent to the use of these methods by us and trusted third parties. For further details or to change your consent choices at any time see our cookie policy. Accept all and visit site Manage your tracker settings