urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-urllib3 | Oct 17, 2023 | Oct 15, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-urllib3Upgrade python2-urllib3 | Mar 13, 2024 | Oct 15, 2023 |
| Oracle_linux | — | Upgrade podman-testsUpgrade podman-dockerUpgrade slirp4netnsUpgrade conmonUpgrade udicaUpgrade container-selinuxUpgrade podman-gvproxyUpgrade critUpgrade podman-pluginsUpgrade criu-develUpgrade libslirpUpgrade crunUpgrade python3-criuUpgrade skopeoUpgrade runcUpgrade skopeo-testsUpgrade cockpit-podmanUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade containers-commonUpgrade netavarkUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade criu-libsUpgrade podmanUpgrade aardvark-dnsUpgrade buildah-testsUpgrade python3-podmanUpgrade criuUpgrade podman-remoteUpgrade fuse-overlayfs | Jul 22, 2024 | Oct 15, 2023 |
| Redhat_linux | — | Upgrade podman-remoteUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade criu-develUpgrade containers-commonUpgrade podman-debugsourceUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeo-testsUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debuginfoUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade slirp4netns-debugsourceUpgrade buildah-debugsourceUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade python3-podmanUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade skopeoUpgrade podman-pluginsUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade netavarkUpgrade buildahUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade podman-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade toolbox-testsUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade podman-testsUpgrade udicaUpgrade aardvark-dnsUpgrade conmon-debugsourceUpgrade criuUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade podman-dockerUpgrade buildah-testsNo solution existsUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade critUpgrade toolbox-debugsourceUpgrade runcUpgrade conmonUpgrade runc-debugsourceUpgrade toolbox-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade conmon-debuginfo | May 23, 2024 | Oct 15, 2023 |
| Rocky_linux | — | Upgrade conmon-debugsourceUpgrade runc-debugsourceUpgrade libslirpUpgrade containers-commonUpgrade crun-debuginfoUpgrade libslirp-develUpgrade toolboxUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade conmonUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade libslirp-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade runcUpgrade runc-debuginfoUpgrade slirp4netnsUpgrade toolbox-debuginfoUpgrade crunUpgrade slirp4netns-debuginfo | Jul 31, 2025 | May 7, 2025 |
| Ubuntu | — | Upgrade python-pip-whl (Ubuntu Pro)Upgrade python3-pip (Ubuntu Pro)Upgrade python-urllib3 (Ubuntu Pro)Upgrade python3-urllib3 (Ubuntu Pro)Upgrade python-pip (Ubuntu Pro) | Nov 8, 2023 | Oct 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub