CVE-2011-1498: Infoleak
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
Other sources
From the httpclient release notes for version 4.1.1 [1]:
[HTTPCLIENT-1061] Fixed critical bug causing Proxy-Authorization header to be sent to the target host when tunneling requests through a proxy server that requires authentication.
[1] http://www.apache.org/dist/httpcomponents/httpclient/RELEASENOTES-4.1.x.txt
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1498?
CVE-2011-1498 is considered to have medium severity due to the potential exposure of sensitive information.
How do I fix CVE-2011-1498?
To fix CVE-2011-1498, upgrade to Apache HttpClient version 4.1.1 or later.
What types of software are affected by CVE-2011-1498?
CVE-2011-1498 affects versions of Apache HttpClient prior to 4.1.1 when used with an authenticating proxy server.
What information could be exposed by CVE-2011-1498?
CVE-2011-1498 could allow remote web servers to log and access sensitive information from the Proxy-Authorization header.
Is CVE-2011-1498 a client-side vulnerability?
Yes, CVE-2011-1498 is a client-side vulnerability affecting applications using older versions of Apache HttpClient.