CVE-2018-25091

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

References

Affected packages

Git / github.com/urllib3/urllib3

Affected ranges

Type

GIT

Repo

https://github.com/urllib3/urllib3

Events

Introduced

Fixed

1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1

Fixed

adb358f8e06865406d1f05e581a16cbea2136fbc

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.24.2"
        }
    ]
}

Affected versions

0.*

0.3

0.3.1

0.4

0.4.1

1.*

1.1

1.10.3

1.10.4

1.11

1.12

1.13

1.13.1

1.14

1.15

1.15.1

1.16

1.18

1.19

1.2

1.2.1

1.20

1.21

1.21.1

1.22

1.23

1.24

1.24.1

1.3

1.4

1.5

1.6

1.7

1.7.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-25091.json"