GHSA-www2-v7xj-xrc6 CVE-2018-20060 PYSEC-2018-32
Exposure of Sensitive Information to an Unauthorized Actor in urllib3
Critical
PyPI
- Severity
- 0.0 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 4.49%
- Chance of exploitation in the next 30 days. Higher than 91.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Fix
1.23- Upgrade urllib3 to this version or later
Description
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| urllib3 | < 1.23 |
1.23 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
urllib3 PyPI → 1.23
- pip
pip install --upgrade "urllib3>=1.23"- poetry
poetry add "urllib3>=1.23"- uv
uv add "urllib3>=1.23"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.0 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Packages
Other links
- github.com/urllib3/urllib3/issues/1316
- github.com/urllib3/urllib3/pull/1346
- github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532
- usn.ubuntu.com/3990-1
- security.netapp.com/advisory/ntap-20241227-0010
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAX…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJER…
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP…
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXL…
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJ…
- lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- github.com/urllib3/urllib3/blob/master/CHANGES.rst
- github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml
- bugzilla.redhat.com/show_bug.cgi
- access.redhat.com/errata/RHSA-2019:2272
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJER…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAX…
- usn.ubuntu.com/3990-1
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-vxq7-64xx-v4gw urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory | High | Also affects urllib3 |
| GHSA-gh4c-6fx4-qh6g urllib3: Chunked Deflate streaming can enter an infinite loop | Medium | Also affects urllib3 |
| GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden | High | Also affects urllib3 |
| GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | High | Also affects urllib3 |
| GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | High | Also affects urllib3 |
| GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) | High | Also affects urllib3 |
| GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data | High | Also affects urllib3 |
| GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain | High | Also affects urllib3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor