A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation.
| Vendor | Product | Versions |
|---|---|---|
| red hat | red hat enterprise linux | — |
Updated vendor to GNOME, changed severity to HIGH, and marked the vulnerability as actively exploited.
Initial creation
