Moderate Security Update for python3.12-urllib3: Cross-Origin Redirect Vulnerability
Summary
ALSA-2024:8842: Moderate: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 1.26.19-1.el8_10. Fixed in 1.26.19-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python that enhances the standard libraries with features such as thread safety, connection pooling, client-side SSL/TLS verification, file uploads with multipart encoding, and support for various encoding methods. It is widely used for making HTTP requests in Python applications. The recent vulnerability identified in urllib3 affects its handling of proxy-authorization request headers during cross-origin redirects, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2024-37891, arises from the failure of urllib3 to strip the proxy-authorization request header during cross-origin redirects. This oversight can lead to unintended exposure of sensitive authorization credentials to third-party servers, posing a significant security risk. Attackers could exploit this vulnerability to gain unauthorized access to user data or perform actions on behalf of the user without consent.
How To Fix
Minimum fixed version
1.26.19-1.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of proxy settings in your application until the package is updated. Additionally, ensure that sensitive data is not transmitted over untrusted networks.
Conclusion
The moderate security update for python3.12-urllib3 addresses a critical vulnerability that could expose sensitive information through improper handling of proxy-authorization headers during cross-origin redirects. It is essential to update to the latest patched version to mitigate this risk.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
CVE-2024-37891 is a security vulnerability in urllib3 that allows the proxy-authorization request header to be exposed during cross-origin redirects.
If your application uses urllib3 and relies on proxy settings, this vulnerability could expose sensitive authorization credentials to third-party servers.
If an immediate update is not possible, consider disabling proxy settings and avoid transmitting sensitive data until the vulnerability is patched.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
