Moderate Vulnerability in python3.12-urllib3: Proxy-Authorization Header Exposure
Summary
RLSA-2024:9457: Moderate: python3.12-urllib3 security update. Affects python3.12-urllib3 versions < 0:1.26.18-2.el9_5.1. Fixed in 0:1.26.18-2.el9_5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a robust and user-friendly HTTP client for Python, designed to enhance the capabilities of the standard library. It offers features such as thread safety, connection pooling, client-side SSL/TLS verification, multipart file uploads, and support for various encodings. This package is widely used in applications requiring reliable HTTP communication. However, it has been found to have a vulnerability that affects the security of cross-origin requests.
Vulnerability Detail
The vulnerability arises from the improper handling of the proxy-authorization request header during cross-origin redirects. This flaw, identified as CVE-2024-37891, could allow sensitive information to be leaked to unintended recipients, potentially leading to unauthorized access or data exposure. The issue stems from the way urllib3 manages headers in redirect scenarios, which can be exploited by attackers to gain insights into user credentials or session tokens.
How To Fix
Minimum fixed version
0:1.26.18-2.el9_5.1
This is the first release that contains the fix.
sudo dnf update python3.12-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually strip the proxy-authorization header from requests before performing cross-origin redirects. This can be done by modifying the request handling logic in the application to ensure that sensitive headers are not passed along during redirects.
Conclusion
In summary, the moderate vulnerability identified in python3.12-urllib3 poses a risk of sensitive information exposure due to improper handling of the proxy-authorization header during cross-origin redirects. It is crucial for users to update to the latest patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for python3.12-urllib3 →
FAQ
CVE-2024-37891 is a vulnerability in the urllib3 package that allows the proxy-authorization request header to be improperly handled during cross-origin redirects, potentially exposing sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
The vulnerability could lead to unauthorized access to sensitive information, such as user credentials or session tokens, if exploited by an attacker.
Yes, a patched version of urllib3 is available. Users should update to version 0:1.26.18-2.el9_5.1 or later to fix the vulnerability.
If an immediate update is not possible, implement a workaround by ensuring that the proxy-authorization header is stripped from requests before any cross-origin redirects.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-urllib3.
