Vulnetix
Try Vulnetix Request Demo
CVE-2018-25091 PUBLISHED

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

EPSS 0.25% · 48.2th percentile

Risk Scores

EPSS Score
0.25%
48.2th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:18.04:LTSpython-pip9.0.1-2.3~ubuntu1.18.04.6, 9.0.1-2.3~ubuntu1.18.04.5+esm3, 9.0.1-2.3~ubuntu1.18.04.5+esm2
Ubuntu:Pro:14.04:LTSpython-pip0, 1.4.1-2, 1.5.4-1
Ubuntu:Pro:14.04:LTSpython-urllib31.6-2, 0, 1.7.1-1
Ubuntu:Pro:16.04:LTSpython-pip8.1.1-2, 8.1.1-2ubuntu0.1, 8.1.1-2ubuntu0.2
Ubuntu:Pro:16.04:LTSpython-urllib31.13.1-2, 1.13.1-1, 1.12-1
Ubuntu:Pro:18.04:LTSpython-urllib31.22-1, 1.21.1-1, 0

Timeline

References

Open in Interactive Console →