CVE-2018-20060

CRITICAL

urllib3 <1.23 - Info Disclosure

Title source: llm

Description

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

References (12)

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2019:2272

[Issue Tracking, Mitigation, Patch, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=1649153

[Release Notes, Third Party Advisory] https://github.com/urllib3/urllib3/blob/master/CHANGES.rst

View Writeup ZIP pw:eip

[Third Party Advisory] https://github.com/urllib3/urllib3/issues/1316

[Third Party Advisory] https://github.com/urllib3/urllib3/pull/1346

[Vendor Advisory] https://usn.ubuntu.com/3990-1/

[Vendor Advisory] https://security.netapp.com/advisory/ntap-20241227-0010/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/

[Mailing List] https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html

Scores

CVSS v3 9.8

EPSS 0.0043

EPSS Percentile 62.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Status published

Affected Products (5)

python/urllib3 < 1.23

fedoraproject/fedora

fedoraproject/fedora

fedoraproject/fedora

pypi/urllib3 < 1.23PyPI

Timeline

Published Dec 11, 2018

Tracked Since Feb 18, 2026