Description
urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-urllib3 | 1.25.6-4 | — |
| Debian 13 | python-urllib3 | 1.25.6-4 | — |
| Debian 12 | python-urllib3 | 1.25.6-4 | — |
| Debian 10 | python-urllib3 | 1.24.1-1+deb10u1 | DLA-3610-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | python-pip | 22.0.2+dfsg-1ubuntu0.4 | USN-6473-2 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.1 | USN-6473-1 |
| Ubuntu 20.04 LTS | python-pip | 20.0.2-5ubuntu1.10 | USN-6473-2 |
| Ubuntu 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.3 | USN-6473-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | python-pip | 9.0.1-2.3~ubuntu1.18.04.8+esm2 | USN-6473-2 |
| Ubuntu Pro 18.04 LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm1 | USN-6473-1 |
| Ubuntu Pro 16.04 LTS | python-pip | 8.1.1-2ubuntu0.6+esm6 | USN-6473-2 |
| Ubuntu Pro 16.04 LTS | python-urllib3 | 1.13.1-2ubuntu0.16.04.4+esm1 | USN-6473-1 |
| Ubuntu Pro 14.04 LTS | python-pip +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+21209+52deeb51 | RHSA-2024:2988 |
| RHEL 8 | buildah +1 | 2:1.33.6-2.module+el8.10.0+21371+46937ece | RHSA-2024:2988 |
| RHEL 8 | cockpit-podman | 84.1-1.module+el8.10.0+21373+0d273fdf | RHSA-2024:2988 |
| RHEL 8 | conmon | 3:2.1.10-1.module+el8.10.0+21077+98b84d8a | RHSA-2024:2988 |
| RHEL 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+21196+3f0abbca | RHSA-2024:2988 |
| RHEL 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+21366+f9cb49f8 | RHSA-2024:2988 |
| RHEL 8 | containers-common | 2:1-81.module+el8.10.0+21340+c6c7475a | RHSA-2024:2988 |
| RHEL 8 | crit +4 | 3.18-4.module+el8.9.0+20326+387084d0 | RHSA-2024:2988 |
| RHEL 8 | crun | 1.14.3-2.module+el8.10.0+21340+c6c7475a | RHSA-2024:2988 |
| RHEL 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+20412+95ee28e2 | RHSA-2024:2988 |
| RHEL 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+20326+387084d0 | RHSA-2024:2988 |
| RHEL 8 | netavark | 2:1.10.3-1.module+el8.10.0+21306+6be40ce7 | RHSA-2024:2988 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+20565+a40ba0e5 | RHSA-2024:2988 |
| RHEL 8 | podman +6 | 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1 | RHSA-2024:2988 |
| RHEL 8 | python-podman +1 | 4.9.0-1.module+el8.10.0+21196+3f0abbca | RHSA-2024:2988 |
| RHEL 8 | runc | 1:1.1.12-1.module+el8.10.0+21251+62b7388c | RHSA-2024:2988 |
| RHEL 8 | skopeo +1 | 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c | RHSA-2024:2988 |
| RHEL 8 | slirp4netns | 1.2.3-1.module+el8.10.0+21306+6be40ce7 | RHSA-2024:2988 |
| RHEL 8 | toolbox +1 | 0.0.99.5-2.module+el8.10.0+21341+ff0b5f89 | RHSA-2024:2988 |
| RHEL 8 | udica | 0.2.6-20.module+el8.9.0+20326+387084d0 | RHSA-2024:2988 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | containers-common | 2:1-81.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | crun | 1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | libslirp | 4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2024:2988 |
| Rocky Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | python-podman | 4.9.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | toolbox | 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:2988 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | python-urllib3 | 1.23-3.25.1 | SUSE-SU-2023:4352-1 |
| SUSE OpenStack Cloud 9 | python-urllib3 | 1.23-3.25.1 | SUSE-SU-2023:4352-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | buildah +1 | 2:1.33.6-2.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | containers-common | 2:1-81.0.1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | crit +4 | 3.18-4.module+el8.9.0+90147+a4870853 | ELSA-2024-2988 |
| Oracle Linux 8 | crun | 1.14.3-2.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+90147+a4870853 | ELSA-2024-2988 |
| Oracle Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | podman +6 | 3:4.9.4-0.1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | python3-podman | 4.9.0-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | skopeo +1 | 2:1.14.3-0.1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+90298+77a9814d | ELSA-2024-2988 |
| Oracle Linux 8 | udica | 0.2.6-20.module+el8.9.0+90147+a4870853 | ELSA-2024-2988 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | < 1.24.2 | 1.24.2 | GHSA-gwvm-45gx-3cf8 |
Advisories 7
- RHSA-2024:2988 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- USN-6473-2 python-pip vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-6473-1 python-urllib3 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3610-1 python-urllib3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:4352-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:2988 Moderate: container-tools:rhel8 security update Rocky Linux Security Advisories · May 7, 2025
- ELSA-2024-2988 Moderate: container-tools:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2024