Moderate Vulnerability in python3.12-urllib3: Proxy-Authorization Header Exposure During Cross-Origin Redirects
Summary
RLSA-2024:8842: Moderate: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 0:1.26.19-1.el8_10. Fixed in 0:1.26.19-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful and user-friendly HTTP client for Python, designed to enhance the capabilities of the standard library. It offers features such as thread safety, connection pooling, client-side SSL/TLS verification, multipart file uploads, and robust support for various encoding methods. The library is widely used for making HTTP requests in Python applications, making it critical for developers to ensure its security and reliability.
Vulnerability Detail
The vulnerability identified in urllib3 (CVE-2024-37891) arises from the improper handling of the proxy-authorization request header during cross-origin redirects. This flaw can potentially expose sensitive authorization credentials to unintended parties, leading to unauthorized access and data breaches. The issue stems from the library's failure to strip the proxy-authorization header when redirecting requests across different origins, which can be exploited by attackers to intercept and misuse these credentials.
How To Fix
Minimum fixed version
0:1.26.19-1.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually strip the proxy-authorization header from requests before they are sent, although this is not a long-term solution. Implementing custom middleware to handle this can help mitigate the risk until the package is updated.
Conclusion
The vulnerability in python3.12-urllib3, identified as CVE-2024-37891, poses a moderate risk due to the exposure of the proxy-authorization header during cross-origin redirects. It is crucial for users to update to the patched version to ensure the security of their applications and protect sensitive information.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
CVE-2024-37891 is a vulnerability in urllib3 that allows the proxy-authorization header to be exposed during cross-origin redirects, potentially leading to unauthorized access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Failing to address this vulnerability could result in sensitive authorization credentials being exposed, leading to unauthorized access and potential data breaches.
Yes, you can implement a temporary workaround by manually stripping the proxy-authorization header from requests until the package is updated.
More information about urllib3 can be found in its official documentation and GitHub repository, which provide insights into its features and usage.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
