Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-66339 →
UBUNTU-CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:16.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.3+esm8"}]}]
Ubuntu:Pro:18.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.1-1ubuntu0.4+esm9"}]}]
Ubuntu:Pro:20.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.0-1ubuntu0.5+esm4"}]}]
Ubuntu:22.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.2-3ubuntu0.9"}]}]
Ubuntu:Pro:22.04:LTS
libsoup3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-0ubuntu1+esm9"}]}]
Ubuntu:24.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-6ubuntu1.9"}]}]
Ubuntu:24.04:LTS
libsoup3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-5ubuntu0.9"}]}]
Ubuntu:26.10
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
libsoup3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
libsoup3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1ubuntu0.1"}]}]
Ubuntu:Pro:26.04:LTS
libsoup2.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.74.3-10.1ubuntu5+esm3"}]}]
Références
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report bugzilla.redhat.com
- report gitlab.gnome.org
- report access.redhat.com