https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 11:22:43 +0000 https://vulnerability.circl.lu/vuln/brew-jupyterlab-ghsa-pw6j-qg29-8w7f <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p># CurlAsyncHTTPClient leaks per-request credentials on handle reuse</p> <p>## Summary</p> <p>`CurlAsyncHTTPClient` pools and reuses `pycurl` handles across requests but does not reset them between requests, and several per-request options are applied with no clearing branch. As a result, sensitive state set by one request persists onto a later request on the same client that does not set it. Two credential vectors are demonstrated below — a client TLS certificate (`SSLCERT`/`SSLKEY`) and proxy basic-auth credentials (`PROXYUSERPWD`) — both leaking to a different, unintended host. This affects all released versions through 6.5.6.</p> <p>## Details</p> <p>In `tornado/curl_httpclient.py`, handles are created once and returned to a free list for reuse (`_process_queue` pops the handle at line 200, `_finish` re-appends it at line 245), and `_curl_setup_request` is never preceded by `curl.reset()`. The function clears *some* carried-over state on the reused handle — `unsetopt(PROXYUSERPWD)` in the no-proxy branch (line 394), `unsetopt(USERPWD)` when no auth is set (line 495), and the HTTP-method flag reset (lines 428-432) — but other options have no equivalent clearing path and persist until a later request sets them again.</p> <p>**Vector A — client TLS certificate (`SSLCERT`/`SSLKEY`).** Set-only, no clearing branch:</p> <p>```python # tornado/curl_httpclient.py (v6.5.6), lines 498-502 if request.client_cert is not None: curl.setopt(pycurl.SSLCERT, request.client_cert)</p> <p>if request.client_key is not None: c…</p> <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p># CurlAsyncHTTPClient leaks per-request credentials on handle reuse</p> <p>## Summary</p> <p>`CurlAsyncHTTPClient` pools and reuses `pycurl` handles across requests but does not reset them between requests, and several per-request options are applied with no clearing branch. As a result, sensitive state set by one request persists onto a later request on the same client that does not set it. Two credential vectors are demonstrated below — a client TLS certificate (`SSLCERT`/`SSLKEY`) and proxy basic-auth credentials (`PROXYUSERPWD`) — both leaking to a different, unintended host. This affects all released versions through 6.5.6.</p> <p>## Details</p> <p>In `tornado/curl_httpclient.py`, handles are created once and returned to a free list for reuse (`_process_queue` pops the handle at line 200, `_finish` re-appends it at line 245), and `_curl_setup_request` is never preceded by `curl.reset()`. The function clears *some* carried-over state on the reused handle — `unsetopt(PROXYUSERPWD)` in the no-proxy branch (line 394), `unsetopt(USERPWD)` when no auth is set (line 495), and the HTTP-method flag reset (lines 428-432) — but other options have no equivalent clearing path and persist until a later request sets them again.</p> <p>**Vector A — client TLS certificate (`SSLCERT`/`SSLKEY`).** Set-only, no clearing branch:</p> <p>```python # tornado/curl_httpclient.py (v6.5.6), lines 498-502 if request.client_cert is not None: curl.setopt(pycurl.SSLCERT, request.client_cert)</p> <p>if request.client_key is not None: c…</p> https://vulnerability.circl.lu/vuln/brew-jupyterlab-ghsa-pw6j-qg29-8w7f https://vulnerability.circl.lu/vuln/cleanstart-2026-gp34045 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-gp34045