CVE-2011-1498

CVE	CVE-2011-1498
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2011-07-07 21:55:00 UTC
Updated	2011-09-22 03:30:00 UTC
Description	Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.

Problem Types: CWE-200

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apache	Httpclient	4.0	All	All	All
Application	Apache	Httpclient	4.0	alpha1	All	All
Application	Apache	Httpclient	4.0	alpha2	All	All
Application	Apache	Httpclient	4.0	alpha3	All	All
Application	Apache	Httpclient	4.0	alpha4	All	All
Application	Apache	Httpclient	4.0	beta1	All	All
Application	Apache	Httpclient	4.0	beta2	All	All
Application	Apache	Httpclient	4.0.1	All	All	All
Application	Apache	Httpclient	4.1	All	All	All
Application	Apache	Httpclient	4.1	alpha1	All	All
Application	Apache	Httpclient	4.1	alpha2	All	All
Application	Apache	Httpclient	4.1	beta1	All	All
Application	Apache	Httpclient	4.0	All	All	All
Application	Apache	Httpclient	4.0	alpha1	All	All
Application	Apache	Httpclient	4.0	alpha2	All	All
Application	Apache	Httpclient	4.0	alpha3	All	All
Application	Apache	Httpclient	4.0	alpha4	All	All
Application	Apache	Httpclient	4.0	beta1	All	All
Application	Apache	Httpclient	4.0	beta2	All	All
Application	Apache	Httpclient	4.0.1	All	All	All
Application	Apache	Httpclient	4.1	All	All	All
Application	Apache	Httpclient	4.1	alpha1	All	All
Application	Apache	Httpclient	4.1	alpha2	All	All
Application	Apache	Httpclient	4.1	beta1	All	All

Reference	Source	Link	Tags
'Proxy-Authorization header received on server side' - MARC	MLIST	marc.info
'Re: Proxy-Authorization header received on server side' - MARC	MLIST	marc.info
oss-security - Re: Apache HttpClient CVE request [VU#153049]	MLIST	openwall.com
709531 – (CVE-2011-1498) CVE-2011-1498 httpcomponents-client: sends Proxy-Authorization header to host when tunneling requests through authenticated proxy server	CONFIRM	bugzilla.redhat.com
'RE: Proxy-Authorization header received on server side' - MARC	MLIST	marc.info
Apache HttpComponents 'HttpClient' Information Disclosure Vulnerability	BID	www.securityfocus.com
'Re: Proxy-Authorization header received on server side' - MARC	MLIST	marc.info
[HTTPCLIENT-1061] Proxy-Authorization header received on server side - ASF JIRA	CONFIRM	issues.apache.org
'RE: Proxy-Authorization header received on server side' - MARC	MLIST	marc.info
404 Not Found	CONFIRM	www.apache.org
Proxy-Authorization header received on server side - SecurityReason.com	SREASON	securityreason.com
CERT Vulnerability Notes Database	CERT-VN	www.kb.cert.org	US Government Resource
oss-security - Apache HttpClient CVE request [VU#153049]	MLIST	openwall.com
[SECURITY] Fedora 15 Update: httpcomponents-client-4.1.1-2.fc15	FEDORA	lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.