CVE-2011-1498 Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient
MediumCVSS 4.3
EPSS 6.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.httpcomponents/httpclient(Maven) | >= 4.0.0, < 4.1.1 | 4.1.1 |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.0.3 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-alpha1 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-alpha2 | No fix listed |
| org.apache.httpcomponents/httpclient(Maven) | = 4.1-beta1 | No fix listed |
| debian/httpcomponents-client(Debian:12) | < 4.1.1-1 | 4.1.1-1 |
| debian/httpcomponents-client(Debian:13) | < 4.1.1-1 | 4.1.1-1 |
| debian/httpcomponents-client(Debian:14) | < 4.1.1-1 | 4.1.1-1 |
| apache httpclient | = 4.0 | No fix listed |
| apache httpclient | = 4.0-alpha1 | No fix listed |
| apache httpclient | = 4.0-alpha2 | No fix listed |
| apache httpclient | = 4.0-alpha3 | No fix listed |
| apache httpclient | = 4.0-alpha4 | No fix listed |
| apache httpclient | = 4.0-beta1 | No fix listed |
| apache httpclient | = 4.0-beta2 | No fix listed |
| apache httpclient | = 4.0.1 | No fix listed |
| apache httpclient | = 4.1 | No fix listed |
| apache httpclient | = 4.1-alpha1 | No fix listed |
| apache httpclient | = 4.1-alpha2 | No fix listed |
| apache httpclient | = 4.1-beta1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugzilla.redhat.com
- github.com product
- issues.apache.org
- FEDORA-2011-7747 vendor-advisory
- [httpclient-users] 20110224 Proxy-Authorization header received on server side mailing-list
- [httpclient-users] 20110224 Re: Proxy-Authorization header received on server side mailing-list
- [httpclient-users] 20110224 RE: Proxy-Authorization header received on server side mailing-list
- [httpclient-users] 20110224 Re: Proxy-Authorization header received on server side mailing-list
- [httpclient-users] 20110224 RE: Proxy-Authorization header received on server side mailing-list
- [oss-security] 20110407 Apache HttpClient CVE request [VU#153049] mailing-list
- [oss-security] 20110408 Re: Apache HttpClient CVE request [VU#153049] mailing-list
- 8298 third-party-advisory
- github.com
- Debian Security Tracker CVE-2011-1498 vendor-advisory
- www.apache.org
- VU#153049 third-party-advisory us-government-resource
- 46974 vdb-entry
- bugs.debian.org issue-tracking