Critical Vulnerability in Python Pip and Urllib3: Proxy-Authorization Header Mismanagement
Summary
UBUNTU-CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python. Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Pip is a package management system for Python, allowing users to install and manage software packages written in Python. Urllib3 is a powerful HTTP client library for Python, providing features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. The vulnerability in question arises from improper handling of the Proxy-Authorization header when HTTP requests are made without utilizing urllib3's proxy support, potentially exposing users to security risks.
Vulnerability Detail
The vulnerability stems from the fact that when using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is correctly sent to the configured proxy. However, if the header is mistakenly set without using the proxy support, it is not stripped during cross-origin redirects. This could lead to the unintentional exposure of sensitive authentication information if certain conditions are met, including not disabling HTTP redirects and redirecting to a malicious origin. The severity of this vulnerability is rated low, with a CVSS score of 4.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the Proxy-Authorization header when not utilizing urllib3's built-in proxy support. Alternatively, users can disable HTTP redirects by setting the redirects parameter to False when sending requests, as shown below:
import urllib3 http = urllib3.PoolManager() response = http.request('GET', 'http://example.com', redirects=False)
Conclusion
In summary, the vulnerability in Python Pip and Urllib3 regarding the Proxy-Authorization header poses a low but significant risk to users who do not utilize the library's proxy support correctly. It is crucial to update to the latest patched versions and consider the provided workarounds to ensure the security of your applications.
See every vulnerability recorded for python-pip →
FAQ
The vulnerability involves improper handling of the Proxy-Authorization header, which could lead to accidental exposure of sensitive information during cross-origin redirects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Users should upgrade to Python Pip version 24.0+dfsg-1ubuntu1.1 and Urllib3 version 1.26.19 or 2.2.2 to mitigate the vulnerability.
Yes, not updating could expose your application to potential security risks, especially if the Proxy-Authorization header is misconfigured.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
