Moderate Vulnerability in python3.11-urllib3: Proxy-Authorization Header Exposure
Summary
ALSA-2024:9458: Moderate: python3.11-urllib3 security update. Affects python3.11-urllib3 versions < 1.26.12-2.el9_5.1. Fixed in 1.26.12-2.el9_5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-urllib3 package is a widely used Python HTTP library that provides essential features such as connection pooling and file POST capabilities. It is integral for developers working with HTTP requests in Python applications, enabling efficient and reliable communication over the web. However, vulnerabilities in this package can lead to security risks, particularly in scenarios involving cross-origin requests.
Vulnerability Detail
The vulnerability identified as CVE-2024-37891 involves the improper handling of the proxy-authorization request header during cross-origin redirects. This flaw allows the proxy-authorization header to be exposed to unintended recipients, potentially leading to unauthorized access to sensitive information. The issue arises from the library's failure to strip this header when redirecting requests, which can be exploited by attackers to gain insights into user credentials or session tokens.
How To Fix
Minimum fixed version
1.26.12-2.el9_5.1
This is the first release that contains the fix.
sudo dnf update python3.11-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures in your application to validate and sanitize headers before processing requests. However, the best approach is to apply the patch as soon as possible.
Conclusion
The python3.11-urllib3 package has a moderate vulnerability (CVE-2024-37891) that can expose sensitive authorization headers during cross-origin redirects. It is crucial to update to the patched version to mitigate this risk. Implementing security best practices and monitoring tools like Vulert can further enhance your application's security posture.
See every vulnerability recorded for python3.11-urllib3 →
FAQ
CVE-2024-37891 is a security vulnerability in the python3.11-urllib3 package that allows the proxy-authorization header to be exposed during cross-origin redirects.
If your application uses python3.11-urllib3 and performs cross-origin requests, this vulnerability could expose sensitive authorization information to attackers.
If an immediate update is not possible, implement additional security measures to validate headers and consider using a temporary workaround until the update can be applied.
More details about CVE-2024-37891 can be found on the official CVE page and through security advisories related to the python3.11-urllib3 package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-urllib3.
