Summary
It was discovered that urllib3 didn't strip HTTP Proxy-Authorization header
on cross-origin redirects. A remote attacker could possibly use this issue
to obtain sensitive information.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | python-urllib3 | 1.25.8-2ubuntu0.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-urllib3 | 2.0.7-1ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-urllib3 | 1.13.1-2ubuntu0.16.04.4+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm2 |
Vulnerabilities 1
-
Medium 4.4
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…
References
-
report
https://ubuntu.com/security/CVE-2024-37891