Summary
It was discovered that urllib3 did not correctly strip sensitive HTTP
headers during cross-origin redirects. An attacker could possibly use this
issue to leak sensitive information.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-urllib3 | 1.13.1-2ubuntu0.16.04.4+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm5 |
Vulnerabilities 1
-
High 8.2
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerabili…
References
-
report
https://ubuntu.com/security/CVE-2026-44431