Vulnerability	Vulnerable Version
H Cleartext Transmission of Sensitive Information httpcore2 is an A minimal low-level HTTP client. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the synchronous and asynchronous SOCKS5 connection implementations, which decide whether to start TLS by testing for the `https` scheme alone and do not include `wss`, so a secure WebSocket connection proceeds unencrypted. An attacker in a MitM position on the proxy path can read credentials, authentication tokens, query parameters, and message content, and impersonate the server, by observing or modifying the handshake and frames, which cross the proxy as plaintext. This requires the application to route `wss://` connections through a SOCKS5 proxy, so direct connections and connections through other proxy types are unaffected. How to fix Cleartext Transmission of Sensitive Information? Upgrade `httpcore2` to version 2.10.0 or higher.	[,2.10.0)

Cleartext Transmission of Sensitive Information

httpcore2 is an A minimal low-level HTTP client.

Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the synchronous and asynchronous SOCKS5 connection implementations, which decide whether to start TLS by testing for the https scheme alone and do not include wss, so a secure WebSocket connection proceeds unencrypted. An attacker in a MitM position on the proxy path can read credentials, authentication tokens, query parameters, and message content, and impersonate the server, by observing or modifying the handshake and frames, which cross the proxy as plaintext. This requires the application to route wss:// connections through a SOCKS5 proxy, so direct connections and connections through other proxy types are unaffected.

How to fix Cleartext Transmission of Sensitive Information?

Upgrade httpcore2 to version 2.10.0 or higher.

[,2.10.0)

Go back to all versions of this package