CVE-2018-20060: Infoleak
Last updated 18 August 2025
Other sources
python-urllib3 before version 1.23 does not remove the 'Authorization' HTTP header when following a cross-origin redirect. This can allow for credentials in the 'Authorization' header to be exposed as they are transmitted in plaintext.
Upstream Issues:
https://github.com/urllib3/urllib3/issues/1316 https://github.com/urllib3/urllib3/pull/1346
— Red Hat
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python-urllib3to a version that resolves this vulnerability.Fixed in 0:1.10.2-7.el7 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.3-7.el7_7 - Upgrade
Upgrade
redhat/python-virtualenvto a version that resolves this vulnerability.Fixed in 0:15.1.0-4.el7_7 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.3-7.el7_8 - Upgrade
Upgrade
redhat/python-virtualenvto a version that resolves this vulnerability.Fixed in 0:15.1.0-4.el7_8 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.3-16.el8 - Upgrade
Upgrade
redhat/python-urllib3to a version that resolves this vulnerability.Fixed in 1.23 - Upgrade
Upgrade
pip/urllib3to a version that resolves this vulnerability.Fixed in 1.23 - Upgrade
Upgrade
debian/python-urllib3to a version that resolves this vulnerability.Fixed in 1.26.5-1~exp1Fixed in 1.26.5-1~exp1+deb11u3Fixed in 1.26.12-1+deb12u1Fixed in 1.26.12-1+deb12u3Fixed in 2.3.0-3Fixed in 2.3.0-3+deb13u1Fixed in 2.6.3-1 - Upgrade
Upgrade
urllib3to a version that resolves this vulnerability.Fixed in 1.23 - Configuration
Use retries=urllib3.Retry(redirect=0) when performing requests if redirects are not needed; handle redirects manually when required.
urllib3 retries = urllib3.Retry(redirect=0)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2018-20060?
CVE-2018-20060 is a vulnerability in urllib3 before version 1.23 that allows for credentials in the Authorization HTTP header to be exposed to unintended hosts or transmitted in cleartext.
What is the severity of CVE-2018-20060?
The severity of CVE-2018-20060 is critical with a severity value of 9.8.
How does CVE-2018-20060 affect urllib3?
CVE-2018-20060 affects urllib3 before version 1.23.
How can I fix CVE-2018-20060?
To fix CVE-2018-20060, upgrade urllib3 to version 1.23 or higher.
Where can I find more information about CVE-2018-20060?
You can find more information about CVE-2018-20060 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-20060), [GitHub Issue](https://github.com/urllib3/urllib3/issues/1316), [GitHub Pull Request](https://github.com/urllib3/urllib3/pull/1346).