GitHub Advisoryadvisory · PyPI

GHSA-www2-v7xj-xrc6 Exposure of Sensitive Information to an Unauthorized Actor in urllib3

CRITICAL Published 2018-12-12 Modified 2024-12-27 Official page ↗
Aliases
CVE-2018-20060
Ecosystem
PyPI
Packages
urllib3
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• PyPI urllib3: < 1.23 → fixed in 1.23

Description

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Related

Alias · CVE (1)

  • CVE-2018-20060 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References