Moderate Vulnerability in python3.12-urllib3: Proxy-Authorization Header Exposure
Summary
ALSA-2024:9457: Moderate: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 1.26.18-2.el9_5.1. Fixed in 1.26.18-2.el9_5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python that enhances the capabilities of the standard library. It includes features such as thread safety, connection pooling, client-side SSL/TLS verification, multipart file uploads, and support for various encoding methods. This package is widely used in applications requiring robust HTTP communication. However, it has been identified to have a security vulnerability that can expose sensitive information during cross-origin redirects.
Vulnerability Detail
The vulnerability arises from the improper handling of the proxy-authorization request header during cross-origin redirects. Specifically, when a request is redirected to a different origin, the proxy-authorization header is not stripped, potentially allowing sensitive authorization credentials to be leaked to unintended recipients. This could lead to unauthorized access or data breaches, making it critical for users of urllib3 to address this issue promptly.
How To Fix
Minimum fixed version
1.26.18-2.el9_5.1
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using proxy settings or implement additional checks in their application to ensure that sensitive headers are not sent during cross-origin requests. However, the best course of action is to apply the update as soon as possible.
Conclusion
The identified vulnerability in python3.12-urllib3 poses a moderate risk due to the potential exposure of sensitive proxy-authorization headers during cross-origin redirects. Users are strongly encouraged to update to the patched version to mitigate this risk. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software dependencies.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
The vulnerability involves the leakage of the proxy-authorization header during cross-origin redirects, which can expose sensitive credentials.
If your application uses urllib3 and performs cross-origin requests with proxy settings, it may be affected. You can check for vulnerabilities using tools like Vulert.
If exploited, this vulnerability could allow unauthorized access to sensitive data or services, leading to data breaches or other security incidents.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your manifest file like package-lock.json.
If an immediate update is not possible, consider implementing workarounds such as avoiding proxy settings or ensuring sensitive headers are not sent during redirects.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
