urllib3@1.25.5 vulnerabilities

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the improper handling of the Proxy-Authorization header during cross-origin redirects when ProxyManager is not in use. When the conditions below are met, including non-recommended configurations, the contents of this header can be sent in an automatic HTTP redirect.

Notes:

To be vulnerable, the application must be doing all of the following:

1. Setting the Proxy-Authorization header without using urllib3's built-in proxy support.

2. Not disabling HTTP redirects (e.g. with redirects=False)

3. Either not using an HTTPS origin server, or having a proxy or target origin that redirects to a malicious origin.

Upgrade urllib3 to version 1.26.19, 2.2.2 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when it processes HTTP redirects with a 303 status code, due to not stripping the request body when changing the request method from POST to GET. An attacker can potentially expose sensitive information by compromising the origin service and redirecting requests to a malicious peer.

Note:

This is only exploitable if sensitive information is being submitted in the HTTP request body and the origin service is compromised, starting to redirect using 303 to a malicious peer or the redirected-to service becomes compromised.

Upgrade urllib3 to version 1.26.18, 2.0.7 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when the Cookie HTTP header is used. An attacker can leak information via HTTP redirects to a different origin by exploiting the fact that the Cookie HTTP header isn't stripped on cross-origin redirects.

Note:

This is only exploitable if the user is using the Cookie header on requests, not disabling HTTP redirects, and either not using HTTPS or for the origin server to redirect to a malicious origin.

##Workaround:

This vulnerability can be mitigated by disabling HTTP redirects using redirects=False when sending requests and by not using the Cookie header.

Upgrade urllib3 to version 1.26.17, 2.0.6 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the SUBAUTHORITY_PAT regex pattern in src/urllib3/util/url.py.

If a URL is passed as a parameter or redirected to via an HTTP redirect and it contains many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service.

Upgrade urllib3 to version 1.26.5 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to HTTP Header Injection. The 'method' parameter is not filtered to prevent the injection from altering the entire request.

For example:

>>> conn = http.client.HTTPConnection("localhost", 80)
>>> conn.request(method="GET / HTTP/1.1\r\nHost: abc\r\nRemainder:", url="/index.html")

This will result in the following request being generated:

GET / HTTP/1.1
Host: abc
Remainder: /index.html HTTP/1.1
Host: localhost
Accept-Encoding: identity

Upgrade urllib3 to version 1.25.9 or higher.

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Denial of Service (DoS). The _encode_invalid_chars function in util/url.py in the urllib3 allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

Upgrade urllib3 to version 1.25.8 or higher.