Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

CVE-2025-46421

Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server

MEDIUM 6.8

En bref

Source
NVD
EPSS
EPSS 0.58 % · centile 48 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Deferred

Description

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.

Faiblesses (CWE)

  • CWE-497 — Exposition d'informations système sensibles à une sphère non autorisée

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Nredhat
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NNVD · secalert@redhat.com (Secondary)

Références européennes

Produits affectés

ProduitVersions
libsoupaffected 0 < 3.6.5
Red Hat · Red Hat Enterprise Linux 10unaffected 0:3.6.5-3.el10_0 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:2.62.3-8.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:2.62.3-8.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:2.62.3-1.el8_2.4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:2.62.3-2.el8_4.4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Telecommunications Update Serviceunaffected 0:2.62.3-2.el8_4.4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Update Services for SAP Solutionsunaffected 0:2.62.3-2.el8_4.4 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:2.62.3-2.el8_6.4 < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected 0:2.62.3-2.el8_6.4 < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected 0:2.62.3-2.el8_6.4 < *
Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Supportunaffected 0:2.62.3-3.el8_8.4 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:2.72.0-10.el9_6.1 < *
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 0:2.72.0-8.el9_0.4 < *
Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Supportunaffected 0:2.72.0-8.el9_2.4 < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 0:2.72.0-8.el9_4.4 < *
Red Hat · Red Hat Enterprise Linux 6
Red Hat · Red Hat Enterprise Linux 7

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD