Critical Vulnerability in urllib3 and python-pip: HTTP Request Body Exposure on Redirects
Summary
UBUNTU-CVE-2023-45803: urllib3 is a user-friendly HTTP client library for Python. Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
urllib3 is a widely used HTTP client library for Python, designed to simplify the process of making HTTP requests. It provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. The vulnerability in question arises from improper handling of HTTP redirects, specifically when the request method is changed from one that allows a body (like POST) to GET, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2023-45803, occurs when urllib3 fails to remove the HTTP request body during an HTTP redirect response (status codes 301, 302, or 303) after changing the request method to GET. This behavior, while not explicitly detailed in the HTTP RFCs, can lead to sensitive data being sent to unintended recipients if the origin service is compromised. The exploitability is considered low, as it requires both the use of urllib3 with sensitive data in the request body and a compromised service that redirects to a malicious endpoint.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you are unable to update the packages immediately, you can disable automatic redirects by setting the 'redirects' parameter to False in your urllib3 requests. For example:
import urllib3 http = urllib3.PoolManager() response = http.request('POST', 'http://example.com', body='data', redirects=False)
Conclusion
The vulnerability CVE-2023-45803 in urllib3 and python-pip poses a risk of exposing sensitive HTTP request bodies during redirects. Users are encouraged to update to the patched versions to mitigate this risk. If immediate updates are not possible, implementing the provided workaround can help reduce exposure.
See every vulnerability recorded for python-pip →
FAQ
CVE-2023-45803 is a vulnerability in urllib3 that allows sensitive HTTP request bodies to be sent to unintended recipients during redirects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The main risk is the exposure of sensitive data if a trusted service is compromised and redirects to a malicious endpoint.
Yes, the vulnerability has been addressed in urllib3 versions 1.26.18 and 2.0.7. Users are advised to update to these versions.
As a temporary workaround, disable automatic redirects in urllib3 by setting the 'redirects' parameter to False.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
