Moderate Vulnerability in python3.11-urllib3: Proxy-Authorization Header Exposure
Summary
ALSA-2024:8843: Moderate: python3.11-urllib3 security update. Affects python3.11-urllib3 versions < 1.26.12-4.el8_10. Fixed in 1.26.12-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-urllib3 package is a widely used Python HTTP client that provides essential features such as connection pooling and file POST capabilities. It is integral for applications that require robust HTTP communication. However, it has been identified to have a security vulnerability that can expose sensitive information during cross-origin redirects, potentially compromising user data and application integrity.
Vulnerability Detail
The vulnerability, identified as CVE-2024-37891, arises from the failure of the urllib3 package to strip the proxy-authorization request header during cross-origin redirects. This oversight can lead to unauthorized access to sensitive information, as the proxy-authorization header may inadvertently be sent to unintended destinations. This could allow attackers to exploit the information contained within the header, leading to further security breaches.
How To Fix
Minimum fixed version
1.26.12-4.el8_10
This is the first release that contains the fix.
sudo dnf update python3.11-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional checks in your application to ensure that sensitive headers are not sent during cross-origin requests. This can involve modifying your HTTP request handling logic to explicitly remove or sanitize such headers before making requests.
Conclusion
The python3.11-urllib3 package has a moderate vulnerability that can expose sensitive information through the proxy-authorization header during cross-origin redirects. It is crucial to update to the patched version to safeguard your application. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.11-urllib3 →
FAQ
CVE-2024-37891 is a security vulnerability in the python3.11-urllib3 package that allows the proxy-authorization header to be sent during cross-origin redirects, potentially exposing sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is the exposure of sensitive information contained in the proxy-authorization header, which could lead to unauthorized access and further exploitation of your application.
Yes, a patch is available. You can update to version 1.26.12-4.el8_10 of the python3.11-urllib3 package to mitigate this vulnerability.
If immediate updating is not possible, implement a workaround by ensuring that sensitive headers are not sent during cross-origin requests until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-urllib3.
