Logic error in authentication in proxy.py

ALTO 7.5CVE-2021-3116 · GHSA-cmc7-mfmr-xqrx · PYSEC-2021-46 · Published 11/01/2021 · updated 17/06/2026

In breve

CVE-2021-3116 è una vulnerabilità ALTO (CVSS 7.5) che riguarda proxy-py, proxy.py (proxy.py project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.3% delle vulnerabilità.
Correzione: aggiornare a 2.3.1 o successiva.

Package	Affected versions	Patched versions
proxy-py PyPI	`< 2.3.1`	`2.3.1`
proxy.py proxy.py_project	`< 2.3.1`	`2.3.1`

Description

before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).

NVD description

before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).

References

nvd.nist.gov/vuln/detail/CVE-2021-3116 · ADVISORY
abhinavsingh/proxy.py#482 · WEB
abhinavsingh/proxy.py#482 · WEB
abhinavsingh/proxy.py commit bff171e · WEB
cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication · WEB
abhinavsingh/proxy.py · PACKAGE
GitHub Advisory GHSA-cmc7-mfmr-xqrx · ADVISORY
pypa/advisory-database · WEB
pypi.org/project/proxy.py/2.3.1 · WEB
cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free