Authorization Header Exposure in urllib3 - CVE-2018-25091
Summary
UBUNTU-CVE-2018-25091: urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python, widely used for making HTTP requests. It provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. However, a vulnerability has been discovered in versions prior to 1.24.2, where the library fails to remove the authorization HTTP header during cross-origin redirects, potentially exposing sensitive credentials.
Vulnerability Detail
The vulnerability identified as CVE-2018-25091 allows for the authorization HTTP header to be retained when following a cross-origin redirect. This means that if a user is redirected to a different host, port, or scheme, their credentials could be inadvertently sent to an unintended destination, leading to unauthorized access or data exposure. The issue arises from an incomplete fix for a previous vulnerability (CVE-2018-20060), which was case-sensitive. The CVSS score for this vulnerability is 6.1, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using urllib3 for making requests that involve cross-origin redirects until the package is updated. Alternatively, consider implementing your own logic to sanitize the authorization header before making such requests.
Conclusion
CVE-2018-25091 represents a significant security risk for applications using vulnerable versions of urllib3, as it can lead to unauthorized access through the exposure of sensitive credentials. It is crucial to update to the latest patched versions to mitigate this risk.
See every vulnerability recorded for python-pip →
FAQ
CVE-2018-25091 is a vulnerability in urllib3 that allows the authorization HTTP header to be sent to unintended hosts during cross-origin redirects, potentially exposing sensitive credentials.
Versions of urllib3 prior to 1.24.2 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without requiring signup.
If an immediate update is not possible, avoid using urllib3 for requests involving cross-origin redirects and implement custom logic to handle authorization headers.
The CVSS score for CVE-2018-25091 is 6.1, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
