CVE-2018-20060 Exposure of Sensitive Information to an Unauthorized Actor in urllib3
CriticalCVSS 9.8
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi urllib3(PyPI) | < 1.23 | 1.23 |
| pypi urllib3(PyPI) | = 0.2 | No fix listed |
| pypi urllib3(PyPI) | = 0.3 | No fix listed |
| pypi urllib3(PyPI) | = 0.3.1 | No fix listed |
| pypi urllib3(PyPI) | = 0.4.0 | No fix listed |
| pypi urllib3(PyPI) | = 0.4.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.0 | No fix listed |
| pypi urllib3(PyPI) | = 1.0.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.0.2 | No fix listed |
| pypi urllib3(PyPI) | = 1.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.10 | No fix listed |
| pypi urllib3(PyPI) | = 1.10.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.10.2 | No fix listed |
| pypi urllib3(PyPI) | = 1.10.3 | No fix listed |
| pypi urllib3(PyPI) | = 1.10.4 | No fix listed |
| pypi urllib3(PyPI) | = 1.11 | No fix listed |
| pypi urllib3(PyPI) | = 1.12 | No fix listed |
| pypi urllib3(PyPI) | = 1.13 | No fix listed |
| pypi urllib3(PyPI) | = 1.13.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.14 | No fix listed |
| pypi urllib3(PyPI) | = 1.15 | No fix listed |
| pypi urllib3(PyPI) | = 1.15.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.16 | No fix listed |
| pypi urllib3(PyPI) | = 1.17 | No fix listed |
| pypi urllib3(PyPI) | = 1.18 | No fix listed |
Show 28 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi urllib3(PyPI) | = 1.18.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.19 | No fix listed |
| pypi urllib3(PyPI) | = 1.19.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.2 | No fix listed |
| pypi urllib3(PyPI) | = 1.2.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.2.2 | No fix listed |
| pypi urllib3(PyPI) | = 1.20 | No fix listed |
| pypi urllib3(PyPI) | = 1.21 | No fix listed |
| pypi urllib3(PyPI) | = 1.21.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.22 | No fix listed |
| pypi urllib3(PyPI) | = 1.3 | No fix listed |
| pypi urllib3(PyPI) | = 1.4 | No fix listed |
| pypi urllib3(PyPI) | = 1.5 | No fix listed |
| pypi urllib3(PyPI) | = 1.6 | No fix listed |
| pypi urllib3(PyPI) | = 1.7 | No fix listed |
| pypi urllib3(PyPI) | = 1.7.1 | No fix listed |
| pypi urllib3(PyPI) | = 1.8 | No fix listed |
| pypi urllib3(PyPI) | = 1.8.2 | No fix listed |
| pypi urllib3(PyPI) | = 1.8.3 | No fix listed |
| pypi urllib3(PyPI) | = 1.9 | No fix listed |
| pypi urllib3(PyPI) | = 1.9.1 | No fix listed |
| debian/python-urllib3(Debian:12) | < 1.24-1 | 1.24-1 |
| debian/python-urllib3(Debian:13) | < 1.24-1 | 1.24-1 |
| debian/python-urllib3(Debian:14) | < 1.24-1 | 1.24-1 |
| python urllib3 | < 1.23 | 1.23 |
| fedoraproject fedora | = 28 | No fix listed |
| fedoraproject fedora | = 29 | No fix listed |
| fedoraproject fedora | = 30 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com patch third-party-advisory
- github.com patch
- USN-3990-1 vendor-advisory
- security.netapp.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- FEDORA-2019-6afaa38e7b vendor-advisory
- FEDORA-2019-8560719e80 vendor-advisory
- FEDORA-2019-a6c56f9756 vendor-advisory
- [debian-lts-announce] 20210615 [SECURITY] [DLA 2686-1] python-urllib3 security update mailing-list
- github.com release-notes third-party-advisory
- github.com product
- github.com
- bugzilla.redhat.com issue-tracking mitigation patch third-party-advisory
- RHSA-2019:2272 vendor-advisory
- openSUSE-SU-2019:2131 vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2018-20060 vendor-advisory