{"id":"CVE-2018-20060","published":"2018-12-11T17:00:00Z","modified":"2024-12-27T16:02:59Z","title":"urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect…","vendor":null,"product":null,"tier":"tail","description":{"text":"urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04488,"percentile":0.91447,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/urllib3/urllib3/issues/1316","tags":["x_refsource_MISC"]},{"url":"https://github.com/urllib3/urllib3/pull/1346","tags":["x_refsource_MISC"]},{"url":"https://github.com/urllib3/urllib3/blob/master/CHANGES.rst","tags":["x_refsource_MISC"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649153","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://usn.ubuntu.com/3990-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2272","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.netapp.com/advisory/ntap-20241227-0010/","tags":[]}],"priority":{"score":18.3,"factors":[{"name":"EPSS percentile","points":18.29}]},"affected":[{"ecosystem":"PyPI","package":"urllib3","vulnerableRanges":["<1.23"],"patched":["1.23"],"from":["GHSA-www2-v7xj-xrc6","PYSEC-2018-32"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0144","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-urllib3-cve-2018-20060","children":[{"from":"CVE-2018-20060","to":"CVE-2018-25091","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).","from":"CVE.org","in":"CVE-2018-25091"},{"kind":"similar","provenance":"machine","score":0.94,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2016-9015","published":"2017-01-11","fixed":"1.18.1","kev":false,"link":{"from":"CVE-2016-9015","to":"CVE-2018-20060","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:urllib3","fromFixed":"1.18.1","toFixed":"1.23","daysApart":699}]}},{"cve":"CVE-2018-20060","published":"2018-12-11","fixed":"1.23","kev":false},{"cve":"CVE-2018-25091","published":"2023-10-15","fixed":"1.24.2","kev":false},{"cve":"CVE-2019-11324","published":"2019-04-18","fixed":"1.24.2","kev":false,"link":{"from":"CVE-2018-20060","to":"CVE-2019-11324","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:urllib3","fromFixed":"1.23","toFixed":"1.24.2","daysApart":128}]}},{"cve":"CVE-2019-11236","published":"2019-04-15","fixed":"1.24.3","kev":false}],"package":"PyPI:urllib3"}}