urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-urllib3 | Oct 17, 2023 | Oct 15, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-urllib3Upgrade python2-urllib3 | Mar 13, 2024 | Oct 15, 2023 |
| Oracle_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade netavarkUpgrade fuse-overlayfsUpgrade criuUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade buildahUpgrade podman-catatonitUpgrade python3-podmanUpgrade podman-remoteUpgrade containers-commonUpgrade libslirp-develUpgrade podmanUpgrade criu-develUpgrade container-selinuxUpgrade podman-gvproxyUpgrade skopeoUpgrade python3-criuUpgrade conmonUpgrade critUpgrade podman-pluginsUpgrade udicaUpgrade slirp4netnsUpgrade skopeo-testsUpgrade podman-testsUpgrade podman-dockerUpgrade libslirpUpgrade runcUpgrade crun | Jul 22, 2024 | Oct 15, 2023 |
| Redhat_linux | — | Upgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade udicaUpgrade toolbox-testsUpgrade buildah-testsUpgrade conmonUpgrade crunUpgrade aardvark-dnsUpgrade toolbox-debuginfoUpgrade toolbox-debugsourceUpgrade podman-dockerUpgrade podman-gvproxy-debuginfoUpgrade podman-testsUpgrade cockpit-podmanUpgrade podmanUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libs-debuginfoUpgrade netavarkUpgrade fuse-overlayfs-debuginfoUpgrade criuUpgrade libslirpUpgrade critUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade runcUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade buildahUpgrade runc-debugsourceUpgrade conmon-debuginfoNo solution existsUpgrade criu-libsUpgrade skopeo-testsUpgrade containernetworking-plugins-debuginfoUpgrade runc-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade criu-develUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade skopeoUpgrade python3-podmanUpgrade python3-criuUpgrade container-selinuxUpgrade toolboxUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debuginfoUpgrade buildah-tests-debuginfoUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade criu-debuginfoUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-remoteUpgrade podman-catatonit-debuginfoUpgrade podman-pluginsUpgrade criu-debugsourceUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade podman-debugsource | May 23, 2024 | Oct 15, 2023 |
| Rocky_linux | — | Upgrade conmonUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade libslirp-develUpgrade libslirpUpgrade toolboxUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade aardvark-dnsUpgrade netavarkUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox-debuginfoUpgrade slirp4netnsUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debugsourceUpgrade runcUpgrade runc-debuginfoUpgrade containernetworking-pluginsUpgrade toolbox-testsUpgrade libslirp-debuginfoUpgrade containernetworking-plugins-debuginfo | Jul 31, 2025 | May 7, 2025 |
| Ubuntu | — | Upgrade python-urllib3 (Ubuntu Pro)Upgrade python3-urllib3 (Ubuntu Pro)Upgrade python-pip (Ubuntu Pro)Upgrade python-pip-whl (Ubuntu Pro)Upgrade python3-pip (Ubuntu Pro) | Nov 8, 2023 | Oct 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub