REDHAT-BUG-2477167: Medium severity pypi/urllib3 vulnerability
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl().urlopen(..., assertsamehost=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
urllib3to a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477167?
The severity of REDHAT-BUG-2477167 is medium with a risk score of 4.
How do I fix REDHAT-BUG-2477167?
You can fix REDHAT-BUG-2477167 by upgrading urllib3 to version 2.7.0 or later.
What is the impact of REDHAT-BUG-2477167?
REDHAT-BUG-2477167 allows sensitive headers to be forwarded during cross-origin redirects, which could lead to potential data leaks.
Which versions of urllib3 are affected by REDHAT-BUG-2477167?
REDHAT-BUG-2477167 affects urllib3 versions from 1.23 up to but not including 2.7.0.
Is there a workaround for REDHAT-BUG-2477167?
There are no specific workarounds recommended for REDHAT-BUG-2477167; upgrading to the fixed version is advised.