Logic error in authentication in proxy.py

높음 7.5CVE-2021-3116 · GHSA-cmc7-mfmr-xqrx · PYSEC-2021-46 · Published 11/01/2021 · updated 17/06/2026

요약

CVE-2021-3116은(는) proxy-py, proxy.py (proxy.py project)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.7%, 전체 취약점의 77.3%보다 높음.
조치: 2.3.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
proxy-py PyPI	`< 2.3.1`	`2.3.1`
proxy.py proxy.py_project	`< 2.3.1`	`2.3.1`

Description

before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).

NVD description

before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).

References

nvd.nist.gov/vuln/detail/CVE-2021-3116 · ADVISORY
abhinavsingh/proxy.py#482 · WEB
abhinavsingh/proxy.py#482 · WEB
abhinavsingh/proxy.py commit bff171e · WEB
cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication · WEB
abhinavsingh/proxy.py · PACKAGE
GitHub Advisory GHSA-cmc7-mfmr-xqrx · ADVISORY
pypa/advisory-database · WEB
pypi.org/project/proxy.py/2.3.1 · WEB
cardaci.xyz/advisories/2021/01/10/proxy.py-2.3.0-broken-basic-authentication · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free