urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-urllib3 | Oct 17, 2023 | Oct 15, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-urllib3Upgrade python3-urllib3 | Mar 13, 2024 | Oct 15, 2023 |
| Oracle_linux | — | Upgrade podman-dockerUpgrade podman-testsUpgrade skopeo-testsUpgrade crunUpgrade container-selinuxUpgrade conmonUpgrade udicaUpgrade slirp4netnsUpgrade skopeoUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade criu-develUpgrade python3-criuUpgrade runcUpgrade libslirpUpgrade critUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade cockpit-podmanUpgrade podman-catatonitUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade podman-remoteUpgrade netavarkUpgrade podmanUpgrade aardvark-dnsUpgrade libslirp-develUpgrade containers-commonUpgrade criuUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade buildah-tests | Jul 22, 2024 | Oct 15, 2023 |
| Redhat_linux | — | Upgrade libslirp-debuginfoUpgrade toolbox-debuginfoUpgrade crunUpgrade conmon-debugsourceUpgrade runcUpgrade podman-debuginfoUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade netavarkUpgrade libslirpUpgrade podmanNo solution existsUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debuginfoUpgrade criuUpgrade buildahUpgrade buildah-testsUpgrade podman-gvproxy-debuginfoUpgrade toolbox-testsUpgrade critUpgrade runc-debugsourceUpgrade conmonUpgrade podman-gvproxyUpgrade udicaUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-debugsourceUpgrade cockpit-podmanUpgrade podman-dockerUpgrade podman-catatonitUpgrade criu-libs-debuginfoUpgrade aardvark-dnsUpgrade podman-testsUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade python3-podmanUpgrade criu-debugsourceUpgrade containers-commonUpgrade libslirp-develUpgrade runc-debuginfoUpgrade container-selinuxUpgrade python3-criuUpgrade skopeoUpgrade criu-develUpgrade skopeo-testsUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-remoteUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-debugsourceUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade libslirp-debugsourceUpgrade buildah-debugsourceUpgrade podman-pluginsUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade criu-debuginfoUpgrade containernetworking-pluginsUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade toolbox | May 23, 2024 | Oct 15, 2023 |
| Rocky_linux | — | Upgrade crun-debuginfoUpgrade netavarkUpgrade aardvark-dnsUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade libslirpUpgrade crun-debugsourceUpgrade libslirp-develUpgrade conmonUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade libslirp-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runcUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade libslirp-debugsourceUpgrade crunUpgrade toolbox-debuginfoUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-testsUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade runc-debuginfo | Jul 31, 2025 | May 7, 2025 |
| Ubuntu | — | Upgrade python3-urllib3 (Ubuntu Pro)Upgrade python-pip (Ubuntu Pro)Upgrade python-urllib3 (Ubuntu Pro)Upgrade python-pip-whl (Ubuntu Pro)Upgrade python3-pip (Ubuntu Pro) | Nov 8, 2023 | Oct 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub