GHSA-34jh-p97f-mpxf: urllib3 fixed in 2.2.2 and 1.26.19

GHSA-34jh-p97f-mpxf PUBLISHED CVSS 4.400000095367432 MEDIUM

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

Record from GitHub Advisory Database · Published June 17, 2024

urllib3 is fixed in 2.2.2 and 1.26.19 (PyPI)

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
urllib3	PyPI	2.2.2, 1.26.19
py3.9-pytorch-cuda-12.3	Chainguard	2.3.1-r1
py3.12-torchvision-cuda-12.3	Chainguard	0.18.1-r2
py3-urllib3	Wolfi	2.2.2-r0
reflex	Wolfi	0.5.5-r0
py3.10-torchvision-cuda-12.3	Chainguard	0.18.1-r4
eco-py3.13-scanner-test-libraries	Chainguard	0.0.1-r2
confluent-docker-utils	Chainguard	0.0.82-r0
kubeflow-jupyter-web-app	Chainguard	1.8.0-r9
py3.11-torchaudio-cuda-12.3	Chainguard	2.3.1-r1
py3.9-torchvision-cuda-12.3	Chainguard	0.18.1-r2
mlflow	Chainguard	2.14.1-r0

60 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

4.400000095367432

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Vendor	Product	Versions
chainguard	py3.9-pytorch-cuda-12.3	0
chainguard	py3.12-torchvision-cuda-12.3	0
wolfi	py3-urllib3	0
wolfi	reflex	0
chainguard	py3.10-torchvision-cuda-12.3	0
chainguard	eco-py3.13-scanner-test-libraries	0
chainguard	confluent-docker-utils	0
chainguard	kubeflow-jupyter-web-app	0
chainguard	py3.11-torchaudio-cuda-12.3	0
chainguard	py3.9-torchvision-cuda-12.3	0
chainguard	mlflow	0
wolfi	superset	0
wolfi	kubeflow-pipelines-visualization-server	0
chainguard	py3.11-pytorch-cuda-12.3	0
chainguard	kubeflow-katib	0
chainguard	az	0
PyPI	urllib3	2.0.0, 0
chainguard	py3.12-pytorch-cuda-12.3	0
chainguard	py3-urllib3-1	0
wolfi	az	0

…and 53 more

Timeline

Jun 17, 2024 CVE Published
Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-34jh-p97f-mpxf
vulnetix vdb fixes GHSA-34jh-p97f-mpxf

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-34jh-p97f-mpxf/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →