REDHAT-BUG-2452932: Medium severity Gnome libsoup vulnerability
Cleartext Transmission of Sensitive Information has been reported in libsoup’s HTTP CONNECT handling. When establishing HTTPS tunnels via soupsession.c::tunnelconnect(), cookies (including potentially sensitive session cookies) are sent in cleartext within the initial HTTP CONNECT request to the configured proxy. A network-positioned attacker or malicious HTTP proxy can intercept or observe these cookies and leverage them for session hijacking or user impersonation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452932?
The severity of REDHAT-BUG-2452932 is classified as medium due to the potential exposure of sensitive information.
How do I fix REDHAT-BUG-2452932?
To fix REDHAT-BUG-2452932, ensure that your application is configured to use secure HTTPS connections without transmitting cookies in cleartext.
What software is affected by REDHAT-BUG-2452932?
REDHAT-BUG-2452932 affects the GNOME libsoup library when handling HTTP CONNECT requests.
What type of vulnerability is REDHAT-BUG-2452932?
REDHAT-BUG-2452932 is a vulnerability categorized as Cleartext Transmission of Sensitive Information.
What can be exposed due to REDHAT-BUG-2452932?
Due to REDHAT-BUG-2452932, session cookies and other sensitive data can be exposed during the initial HTTP CONNECT request.