Homepage
About Snyk

Information Exposure Through Sent Data Affecting urllib3 package, versions [,1.24.2)

0.0
high

Snyk CVSS

    Attack Complexity Low
    User Interaction Required
    Scope Changed
    Confidentiality High

    Threat Intelligence

    EPSS 0.07% (31st percentile)
Expand this section
NVD
6.1 medium
Expand this section
Red Hat
6.1 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-URLLIB3-5969479
  • published 16 Oct 2023
  • disclosed 15 Oct 2023
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 15 Oct 2023

CVE-2018-25091 Open this link in a new tab
CWE-200 Open this link in a new tab

How to fix?

Upgrade urllib3 to version 1.24.2 or higher.

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when the authorization HTTP header is not removed during a cross-origin redirect. An attacker can expose credentials in the authorisation header to unintended hosts or transmit them in cleartext by exploiting this incomplete fix for CVE-2018-20060.

Notes: This is only exploitable if a redirect differs in host, port, or scheme.

Due to the credential exposure in the authorisation header, the Confidentiality is highly impacted, but there is no proof that the Integrity is affected in any way.