CVE-2014-8650

Python-requests-Kerberos 0.5 has a vulnerability lacking mutual authentication support

• CVSS 9.8
• CWE-287 Improper Authentication
• Authentication, Authorization, and Session Management
• Remote

python-requests-Kerberos through 0.5 does not handle mutual authentication

CVE

CVE-2014-8650

CWE

CWE-287 Improper Authentication

CVSS base score

9.8

Published

2019-12-15

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update python-requests-Kerberos to version 0.5.1 or higher.

import requests
from requests_kerberos import HTTPKerberosAuth

kerberos_auth = HTTPKerberosAuth()

response = requests.get('http://example.com', auth=kerberos_auth)

print(response.content)

import requests
from requests_kerberos import HTTPKerberosAuth, OPTIONAL

kerberos_auth = HTTPKerberosAuth(mutual_authentication=OPTIONAL)

response = requests.get('http://example.com', auth=kerberos_auth)

print(response.content)

@misc{vaitp:cve20148650,
  title        = {{Python-requests-Kerberos 0.5 has a vulnerability lacking mutual authentication support}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-8650},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-8650/}}
}