Search for packages
| purl | pkg:pypi/urllib3@1.24 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1cgk-q3r3-aaam
Aliases: CVE-2024-37891 GHSA-34jh-p97f-mpxf |
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. ## Affected usages We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: * Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. * Not disabling HTTP redirects. * Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. ## Remediation * Using the `Proxy-Authorization` header with urllib3's `ProxyManager`. * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Proxy-Authorization` header. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-6rq6-hxp1-aaae
Aliases: CVE-2021-33503 GHSA-q2q7-5pp4-w6pg PYSEC-2021-108 |
Uncontrolled Resource Consumption An issue was discovered in urllib3, when provided with a URL containing many `@` characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. |
Affected by 6 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-7ghb-wt6a-aaah
Aliases: CVE-2020-26137 GHSA-wqvq-5m8c-6g24 PYSEC-2020-148 |
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. |
Affected by 4 other vulnerabilities. |
|
VCID-c4sy-7zv4-aaas
Aliases: CVE-2023-43804 GHSA-v845-jxx5-vc9f PYSEC-0000-CVE-2023-43804 PYSEC-2023-192 |
`Cookie` HTTP header isn't stripped on cross-origin redirects |
Affected by 2 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-mzxq-w8z6-aaah
Aliases: CVE-2018-25091 GHSA-gwvm-45gx-3cf8 PYSEC-0000-CVE-2018-25091 PYSEC-2023-207 |
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive). |
Affected by 6 other vulnerabilities. |
|
VCID-n7px-rq6v-aaaa
Aliases: CVE-2019-11324 GHSA-mh33-7rrq-662w PYSEC-2019-133 PYSEC-2019-63 |
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. |
Affected by 6 other vulnerabilities. |
|
VCID-r496-vgsm-aaac
Aliases: CVE-2023-45803 GHSA-g4mx-q9vg-27p4 PYSEC-0000-CVE-2023-45803 PYSEC-2023-212 |
urllib3's request body not stripped after redirect from 303 status changes request method to GET |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-v8kv-yq79-aaar
Aliases: CVE-2019-11236 GHSA-r64q-w8jr-g9qp PYSEC-2019-132 PYSEC-2019-62 |
In the urllib3 library for Python, CRLF injection is possible if the attacker controls the request parameter. |
Affected by 5 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||