CoreCVE
Back

CRITICAL

python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure

Published Dec 11, 2018

Description

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Affected products

Remediation

Red Hat statement

Red Hat Satellite 6.2 is on Maintenance Support 2 phase, hence only selected critical and important issues will be fixed. Please refer to Red Hat Satellite Product Life Cycle page for more information. In Red Hat OpenStack Platform 13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-urllib3 package.

Red Hat mitigation

Use `retries=urllib3.Retry(redirect=0)` when performing requests if you do not need redirection and handle the redirects manually if you need them.

Metrics

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-522

Insufficiently Protected Credentials

References (21)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 11, 2018
Updated Dec 27, 2024
Reserved Dec 11, 2018
Link CVE-2018-20060
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-20060
Red Hat
Severity Moderate
Public date Mar 26, 2018
Links CVE-2018-20060 - Bugzilla
GHSA-WWW2-V7XJ-XRC6