Critical Vulnerability in Python-urllib3: Exposure of Authorization Headers on Cross-Origin Redirects
Summary
UBUNTU-CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). Affects python-urllib3 versions 1.6-2 – 1.7.1-1ubuntu4.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-urllib3 is a powerful, user-friendly HTTP client for Python, designed to simplify the process of making HTTP requests. It is widely used in various applications for its robust features, including connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. However, a significant vulnerability has been identified in versions prior to 1.23, which can lead to the unintended exposure of sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2018-20060, arises from urllib3's failure to remove the Authorization HTTP header when following cross-origin redirects. This means that if a request is redirected to a different host, port, or scheme, the Authorization header, which may contain sensitive credentials, could be sent to unintended recipients. This poses a severe security risk, as it allows for potential credential leakage and unauthorized access to sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing strict controls on cross-origin requests and avoid using sensitive credentials in the Authorization header when making requests that may be redirected. Additionally, review your application’s handling of HTTP headers to mitigate risks.
Conclusion
In summary, CVE-2018-20060 is a critical vulnerability in python-urllib3 that can lead to the exposure of sensitive credentials through the Authorization HTTP header during cross-origin redirects. It is crucial to update to the patched version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for python-urllib3 →
FAQ
CVE-2018-20060 is a vulnerability in urllib3 that allows the Authorization HTTP header to be exposed during cross-origin redirects, potentially leaking sensitive credentials.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions of python-urllib3 prior to 1.23 are affected by this vulnerability.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
If immediate updates are not possible, implement strict controls on cross-origin requests and avoid using sensitive credentials in the Authorization header.
Related vulnerabilities
Recent vulnerabilities recorded for python-urllib3.
