urllib3@1.19 vulnerabilities

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the improper handling of the Proxy-Authorization header during cross-origin redirects when ProxyManager is not in use. When the conditions below are met, including non-recommended configurations, the contents of this header can be sent in an automatic HTTP redirect.

Notes:

To be vulnerable, the application must be doing all of the following:

1. Setting the Proxy-Authorization header without using urllib3's built-in proxy support.

2. Not disabling HTTP redirects (e.g. with redirects=False)

3. Either not using an HTTPS origin server, or having a proxy or target origin that redirects to a malicious origin.

Upgrade urllib3 to version 1.26.19, 2.2.2 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when it processes HTTP redirects with a 303 status code, due to not stripping the request body when changing the request method from POST to GET. An attacker can potentially expose sensitive information by compromising the origin service and redirecting requests to a malicious peer.

Note:

This is only exploitable if sensitive information is being submitted in the HTTP request body and the origin service is compromised, starting to redirect using 303 to a malicious peer or the redirected-to service becomes compromised.

Upgrade urllib3 to version 1.26.18, 2.0.7 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when the authorization HTTP header is not removed during a cross-origin redirect. An attacker can expose credentials in the authorisation header to unintended hosts or transmit them in cleartext by exploiting this incomplete fix for CVE-2018-20060.

Notes: This is only exploitable if a redirect differs in host, port, or scheme.

Due to the credential exposure in the authorisation header, the Confidentiality is highly impacted, but there is no proof that the Integrity is affected in any way.

Upgrade urllib3 to version 1.24.2 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when the Cookie HTTP header is used. An attacker can leak information via HTTP redirects to a different origin by exploiting the fact that the Cookie HTTP header isn't stripped on cross-origin redirects.

Note:

This is only exploitable if the user is using the Cookie header on requests, not disabling HTTP redirects, and either not using HTTPS or for the origin server to redirect to a malicious origin.

##Workaround:

This vulnerability can be mitigated by disabling HTTP redirects using redirects=False when sending requests and by not using the Cookie header.

Upgrade urllib3 to version 1.26.17, 2.0.6 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the SUBAUTHORITY_PAT regex pattern in src/urllib3/util/url.py.

If a URL is passed as a parameter or redirected to via an HTTP redirect and it contains many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service.

Upgrade urllib3 to version 1.26.5 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to HTTP Header Injection. The 'method' parameter is not filtered to prevent the injection from altering the entire request.

For example:

>>> conn = http.client.HTTPConnection("localhost", 80)
>>> conn.request(method="GET / HTTP/1.1\r\nHost: abc\r\nRemainder:", url="/index.html")

This will result in the following request being generated:

GET / HTTP/1.1
Host: abc
Remainder: /index.html HTTP/1.1
Host: localhost
Accept-Encoding: identity

Upgrade urllib3 to version 1.25.9 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Certificate Validation. It mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates. This can result in SSL connections succeeding in situations where it should have failed.

Upgrade urllib3 to version 1.24.2 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to CRLF injection. Attacker who has the control of the requesting address parameter, could manipulate an HTTP header and attack an internal service.

Upgrade urllib3 to version 1.24.3 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Authentication Bypass. It did remove the Authorization HTTP header when following a cross-origin redirect. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Upgrade urllib3 to version 1.23 or higher.