Search for packages
| purl | pkg:deb/debian/python-urllib3@1.3-3 |
| Next non-vulnerable version | 1.26.12-1+deb12u1 |
| Latest non-vulnerable version | 1.26.12-1+deb12u1 |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1cgk-q3r3-aaam
Aliases: CVE-2024-37891 GHSA-34jh-p97f-mpxf |
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. ## Affected usages We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: * Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. * Not disabling HTTP redirects. * Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. ## Remediation * Using the `Proxy-Authorization` header with urllib3's `ProxyManager`. * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Proxy-Authorization` header. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-3s2w-ytft-aaar
Aliases: CVE-2018-20060 GHSA-www2-v7xj-xrc6 PYSEC-2018-32 |
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. |
Affected by 10 other vulnerabilities. |
|
VCID-457q-9vme-aaac
Aliases: CVE-2020-7212 GHSA-hmv2-79q8-fv6g PYSEC-2020-149 |
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2). |
Affected by 3 other vulnerabilities. |
|
VCID-6rq6-hxp1-aaae
Aliases: CVE-2021-33503 GHSA-q2q7-5pp4-w6pg PYSEC-2021-108 |
Uncontrolled Resource Consumption An issue was discovered in urllib3, when provided with a URL containing many `@` characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. |
Affected by 3 other vulnerabilities. |
|
VCID-7ghb-wt6a-aaah
Aliases: CVE-2020-26137 GHSA-wqvq-5m8c-6g24 PYSEC-2020-148 |
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. |
Affected by 3 other vulnerabilities. |
|
VCID-9ruw-cgv6-aaar
Aliases: CVE-2021-28363 GHSA-5phf-pp7p-vc2r PYSEC-2021-59 |
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted. |
Affected by 3 other vulnerabilities. |
|
VCID-c4sy-7zv4-aaas
Aliases: CVE-2023-43804 GHSA-v845-jxx5-vc9f PYSEC-0000-CVE-2023-43804 PYSEC-2023-192 |
`Cookie` HTTP header isn't stripped on cross-origin redirects |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-mzxq-w8z6-aaah
Aliases: CVE-2018-25091 GHSA-gwvm-45gx-3cf8 PYSEC-0000-CVE-2018-25091 PYSEC-2023-207 |
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive). |
Affected by 3 other vulnerabilities. |
|
VCID-n7px-rq6v-aaaa
Aliases: CVE-2019-11324 GHSA-mh33-7rrq-662w PYSEC-2019-133 PYSEC-2019-63 |
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. |
Affected by 3 other vulnerabilities. |
|
VCID-r496-vgsm-aaac
Aliases: CVE-2023-45803 GHSA-g4mx-q9vg-27p4 PYSEC-0000-CVE-2023-45803 PYSEC-2023-212 |
urllib3's request body not stripped after redirect from 303 status changes request method to GET |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-us5b-bv9a-aaaa
Aliases: CVE-2013-2099 |
Uncontrolled Resource Consumption Algorithmic complexity vulnerability in the `ssl.match_hostname` function and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate. |
Affected by 11 other vulnerabilities. |
|
VCID-v8kv-yq79-aaar
Aliases: CVE-2019-11236 GHSA-r64q-w8jr-g9qp PYSEC-2019-132 PYSEC-2019-62 |
In the urllib3 library for Python, CRLF injection is possible if the attacker controls the request parameter. |
Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-06-21T17:57:01.155769+00:00 | Debian Oval Importer | Affected by | VCID-v8kv-yq79-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T15:46:55.047012+00:00 | Debian Oval Importer | Affected by | VCID-7ghb-wt6a-aaah | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T15:25:17.838115+00:00 | Debian Oval Importer | Affected by | VCID-3s2w-ytft-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T14:07:41.327317+00:00 | Debian Oval Importer | Affected by | VCID-mzxq-w8z6-aaah | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T13:13:14.773982+00:00 | Debian Oval Importer | Affected by | VCID-r496-vgsm-aaac | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T12:58:15.548848+00:00 | Debian Oval Importer | Affected by | VCID-n7px-rq6v-aaaa | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T12:51:56.693031+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T12:35:03.186746+00:00 | Debian Oval Importer | Affected by | VCID-c4sy-7zv4-aaas | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.3 |
| 2025-06-21T05:58:32.892252+00:00 | Debian Oval Importer | Affected by | VCID-9ruw-cgv6-aaar | None | 36.1.3 |
| 2025-06-21T05:19:39.978457+00:00 | Debian Oval Importer | Affected by | VCID-n7px-rq6v-aaaa | None | 36.1.3 |
| 2025-06-21T04:47:06.252792+00:00 | Debian Oval Importer | Affected by | VCID-v8kv-yq79-aaar | None | 36.1.3 |
| 2025-06-21T03:58:43.471558+00:00 | Debian Oval Importer | Affected by | VCID-7ghb-wt6a-aaah | None | 36.1.3 |
| 2025-06-21T03:16:19.722123+00:00 | Debian Oval Importer | Affected by | VCID-457q-9vme-aaac | None | 36.1.3 |
| 2025-06-21T03:06:42.400403+00:00 | Debian Oval Importer | Affected by | VCID-6rq6-hxp1-aaae | None | 36.1.3 |
| 2025-06-20T22:38:51.323897+00:00 | Debian Oval Importer | Affected by | VCID-3s2w-ytft-aaar | None | 36.1.3 |
| 2025-06-20T22:01:41.614599+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | None | 36.1.3 |
| 2025-06-08T13:17:39.280437+00:00 | Debian Oval Importer | Affected by | VCID-mzxq-w8z6-aaah | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.1.0 |
| 2025-06-08T12:26:48.202112+00:00 | Debian Oval Importer | Affected by | VCID-3s2w-ytft-aaar | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.1.0 |
| 2025-06-08T10:28:42.989706+00:00 | Debian Oval Importer | Affected by | VCID-v8kv-yq79-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T08:40:22.837857+00:00 | Debian Oval Importer | Affected by | VCID-7ghb-wt6a-aaah | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T08:19:51.191197+00:00 | Debian Oval Importer | Affected by | VCID-3s2w-ytft-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T07:01:17.216370+00:00 | Debian Oval Importer | Affected by | VCID-mzxq-w8z6-aaah | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T06:07:55.639350+00:00 | Debian Oval Importer | Affected by | VCID-r496-vgsm-aaac | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T05:53:13.926021+00:00 | Debian Oval Importer | Affected by | VCID-n7px-rq6v-aaaa | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T05:46:58.916322+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-08T05:33:09.464604+00:00 | Debian Oval Importer | Affected by | VCID-c4sy-7zv4-aaas | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.1.0 |
| 2025-06-07T23:37:09.400739+00:00 | Debian Oval Importer | Affected by | VCID-9ruw-cgv6-aaar | None | 36.1.0 |
| 2025-06-07T22:57:18.088797+00:00 | Debian Oval Importer | Affected by | VCID-n7px-rq6v-aaaa | None | 36.1.0 |
| 2025-06-07T22:24:10.955519+00:00 | Debian Oval Importer | Affected by | VCID-v8kv-yq79-aaar | None | 36.1.0 |
| 2025-06-07T21:34:00.067404+00:00 | Debian Oval Importer | Affected by | VCID-7ghb-wt6a-aaah | None | 36.1.0 |
| 2025-06-07T20:49:20.367157+00:00 | Debian Oval Importer | Affected by | VCID-457q-9vme-aaac | None | 36.1.0 |
| 2025-06-07T20:39:27.840693+00:00 | Debian Oval Importer | Affected by | VCID-6rq6-hxp1-aaae | None | 36.1.0 |
| 2025-06-07T16:02:48.985817+00:00 | Debian Oval Importer | Affected by | VCID-3s2w-ytft-aaar | None | 36.1.0 |
| 2025-06-07T15:25:19.684153+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | None | 36.1.0 |
| 2025-04-13T02:36:50.543746+00:00 | Debian Oval Importer | Affected by | VCID-c4sy-7zv4-aaas | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-13T02:36:43.727514+00:00 | Debian Oval Importer | Affected by | VCID-r496-vgsm-aaac | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-13T02:36:36.530063+00:00 | Debian Oval Importer | Affected by | VCID-1cgk-q3r3-aaam | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T22:37:25.783859+00:00 | Debian Oval Importer | Affected by | VCID-v8kv-yq79-aaar | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T22:07:02.366334+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T22:02:52.349034+00:00 | Debian Oval Importer | Affected by | VCID-n7px-rq6v-aaaa | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T21:44:47.610338+00:00 | Debian Oval Importer | Affected by | VCID-7ghb-wt6a-aaah | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T21:37:22.352163+00:00 | Debian Oval Importer | Affected by | VCID-6rq6-hxp1-aaae | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T21:01:35.396397+00:00 | Debian Oval Importer | Affected by | VCID-9ruw-cgv6-aaar | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T19:35:09.548866+00:00 | Debian Oval Importer | Affected by | VCID-457q-9vme-aaac | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T19:05:40.071510+00:00 | Debian Oval Importer | Affected by | VCID-mzxq-w8z6-aaah | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T18:13:01.256283+00:00 | Debian Oval Importer | Affected by | VCID-3s2w-ytft-aaar | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 36.0.0 |
| 2025-04-12T16:09:57.744408+00:00 | Debian Oval Importer | Affected by | VCID-v8kv-yq79-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T07:11:49.815470+00:00 | Debian Oval Importer | Affected by | VCID-7ghb-wt6a-aaah | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T06:51:11.466140+00:00 | Debian Oval Importer | Affected by | VCID-3s2w-ytft-aaar | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T05:33:57.698308+00:00 | Debian Oval Importer | Affected by | VCID-mzxq-w8z6-aaah | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T04:39:57.556941+00:00 | Debian Oval Importer | Affected by | VCID-r496-vgsm-aaac | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T04:25:04.040514+00:00 | Debian Oval Importer | Affected by | VCID-n7px-rq6v-aaaa | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T04:18:45.344207+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-08T04:04:33.210529+00:00 | Debian Oval Importer | Affected by | VCID-c4sy-7zv4-aaas | https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 | 36.0.0 |
| 2025-04-07T22:09:14.767282+00:00 | Debian Oval Importer | Affected by | VCID-9ruw-cgv6-aaar | None | 36.0.0 |
| 2025-04-07T21:29:20.286640+00:00 | Debian Oval Importer | Affected by | VCID-n7px-rq6v-aaaa | None | 36.0.0 |
| 2025-04-07T20:55:43.302830+00:00 | Debian Oval Importer | Affected by | VCID-v8kv-yq79-aaar | None | 36.0.0 |
| 2025-04-07T20:03:17.801961+00:00 | Debian Oval Importer | Affected by | VCID-7ghb-wt6a-aaah | None | 36.0.0 |
| 2025-04-07T19:19:46.844338+00:00 | Debian Oval Importer | Affected by | VCID-457q-9vme-aaac | None | 36.0.0 |
| 2025-04-07T19:09:56.528119+00:00 | Debian Oval Importer | Affected by | VCID-6rq6-hxp1-aaae | None | 36.0.0 |
| 2025-04-07T14:33:57.469963+00:00 | Debian Oval Importer | Affected by | VCID-3s2w-ytft-aaar | None | 36.0.0 |
| 2025-04-07T13:56:35.628617+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | None | 36.0.0 |
| 2024-12-11T08:23:12.267176+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 35.0.0 |
| 2024-10-15T06:49:13.284420+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 34.0.2 |
| 2024-10-05T04:51:47.567745+00:00 | Debian Oval Importer | Affected by | VCID-us5b-bv9a-aaaa | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 34.0.1 |