urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-urllib3 | Oct 17, 2023 | Oct 15, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-urllib3Upgrade python3-urllib3 | Mar 13, 2024 | Oct 15, 2023 |
| Oracle_linux | — | Upgrade slirp4netnsUpgrade critUpgrade conmonUpgrade udicaUpgrade skopeo-testsUpgrade python3-criuUpgrade runcUpgrade crunUpgrade libslirpUpgrade podman-pluginsUpgrade podman-dockerUpgrade criu-develUpgrade skopeoUpgrade podman-testsUpgrade container-selinuxUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade podman-catatonitUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade aardvark-dnsUpgrade python3-podmanUpgrade containernetworking-pluginsUpgrade criuUpgrade criu-libsUpgrade buildah-testsUpgrade containers-commonUpgrade cockpit-podmanUpgrade libslirp-develUpgrade podman | Jul 22, 2024 | Oct 15, 2023 |
| Redhat_linux | — | Upgrade conmonUpgrade runc-debugsourceUpgrade podman-testsUpgrade toolbox-debuginfoUpgrade cockpit-podmanUpgrade containernetworking-plugins-debugsourceUpgrade aardvark-dnsUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade udicaUpgrade libslirpUpgrade critUpgrade toolbox-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criuUpgrade runcUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoNo solution existsUpgrade libslirp-debuginfoUpgrade toolbox-debugsourceUpgrade podmanUpgrade podman-debuginfoUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade podman-catatonitUpgrade crunUpgrade conmon-debuginfoUpgrade podman-dockerUpgrade netavarkUpgrade slirp4netnsUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade buildahUpgrade slirp4netns-debuginfoUpgrade podman-plugins-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade criu-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade container-selinuxUpgrade criu-libsUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade crun-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-remoteUpgrade criu-debugsourceUpgrade criu-develUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfoUpgrade skopeoUpgrade toolboxUpgrade python3-podmanUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade buildah-debugsourceUpgrade crun-debuginfoUpgrade skopeo-testsUpgrade buildah-tests-debuginfo | May 23, 2024 | Oct 15, 2023 |
| Rocky_linux | — | Upgrade containernetworking-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade slirp4netns-debugsourceUpgrade toolbox-debugsourceUpgrade libslirp-debugsourceUpgrade toolbox-testsUpgrade slirp4netnsUpgrade toolbox-debuginfoUpgrade crunUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade containernetworking-pluginsUpgrade runc-debuginfoUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade libslirpUpgrade libslirp-develUpgrade conmonUpgrade conmon-debugsourceUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade aardvark-dnsUpgrade netavarkUpgrade crun-debuginfoUpgrade runc-debugsource | Jul 31, 2025 | May 7, 2025 |
| Ubuntu | — | Upgrade python3-urllib3 (Ubuntu Pro)Upgrade python-pip (Ubuntu Pro)Upgrade python-urllib3 (Ubuntu Pro)Upgrade python-pip-whl (Ubuntu Pro)Upgrade python3-pip (Ubuntu Pro) | Nov 8, 2023 | Oct 15, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub