Logic error in authentication in proxy.py

HOCH 7.5CVE-2021-3116 · GHSA-cmc7-mfmr-xqrx · PYSEC-2021-46 · Published 11/01/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-3116 ist eine Schwachstelle (HOCH (CVSS 7.5)) in proxy-py, proxy.py (proxy.py project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.7%, höher als bei 77.3% aller Schwachstellen.
Abhilfe: auf 2.3.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
proxy-py PyPI	`< 2.3.1`	`2.3.1`
proxy.py proxy.py_project	`< 2.3.1`	`2.3.1`

Description

before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).

NVD description

before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).

References

nvd.nist.gov/vuln/detail/CVE-2021-3116 · ADVISORY
abhinavsingh/proxy.py#482 · WEB
abhinavsingh/proxy.py#482 · WEB
abhinavsingh/proxy.py commit bff171e · WEB
cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication · WEB
abhinavsingh/proxy.py · PACKAGE
GitHub Advisory GHSA-cmc7-mfmr-xqrx · ADVISORY
pypa/advisory-database · WEB
pypi.org/project/proxy.py/2.3.1 · WEB
cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free