Critical Vulnerability in urllib3 and python-pip: Cookie Header Leakage Risk
Summary
UBUNTU-CVE-2023-43804: urllib3 is a user-friendly HTTP client library for Python. Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a widely-used HTTP client library for Python, known for its user-friendly interface and robust features. It facilitates seamless communication over HTTP, handling connections, and managing requests efficiently. However, a recent vulnerability has been identified that allows users to inadvertently leak sensitive information through the Cookie HTTP header during HTTP redirects, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from urllib3's handling of the Cookie HTTP header, which does not provide special treatment or management for cookies. Users can specify a Cookie header, and if they do not explicitly disable redirects, sensitive information may be leaked to different origins during HTTP redirects. This issue has been patched in urllib3 versions 1.26.17 and 2.0.5, and it has a CVSS score of 5.9, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable HTTP redirects when making requests using urllib3. This can be done by setting the redirect parameter to False in the request method, as shown below:
import urllib3 http = urllib3.PoolManager() response = http.request('GET', 'http://example.com', redirect=False)
Conclusion
The vulnerability in urllib3 and python-pip poses a significant risk of information leakage through the Cookie HTTP header during redirects. It is crucial for users to update their packages to the latest patched versions or implement workarounds to mitigate the risk. Regular monitoring of open-source vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for python-pip →
FAQ
The vulnerability can lead to the unintentional leakage of sensitive information via HTTP redirects, potentially exposing user data to malicious actors.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
Versions of urllib3 prior to 1.26.17 and 2.0.5 are affected by this vulnerability.
Yes, you can disable HTTP redirects in your requests to prevent the leakage of sensitive information.
If an immediate update is not possible, implement the workaround by disabling redirects in your HTTP requests until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
