Information Exposure Through Sent Data Affecting urllib3 package, versions [,1.24.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-URLLIB3-5969479
- published 16 Oct 2023
- disclosed 15 Oct 2023
- credit Unknown
Introduced: 15 Oct 2023
CVE-2018-25091 Open this link in a new tabHow to fix?
Upgrade urllib3 to version 1.24.2 or higher.
Overview
urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.
Affected versions of this package are vulnerable to Information Exposure Through Sent Data when the authorization HTTP header is not removed during a cross-origin redirect. An attacker can expose credentials in the authorisation header to unintended hosts or transmit them in cleartext by exploiting this incomplete fix for CVE-2018-20060.
Notes: This is only exploitable if a redirect differs in host, port, or scheme.
Due to the credential exposure in the authorisation header, the Confidentiality is highly impacted, but there is no proof that the Integrity is affected in any way.