9.8

CVE-2018-20060

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Urllib3 Version < 1.23
Fedoraproject ≫ Fedora Version28
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.49% 0.902
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
https://access.redhat.com/errata/RHSA-2019:2272
https://bugzilla.redhat.com/show_bug.cgi?id=1649153
Patch
Third Party Advisory
Issue Tracking
Mitigation
https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
Third Party Advisory
Release Notes
https://github.com/urllib3/urllib3/issues/1316
Third Party Advisory
https://github.com/urllib3/urllib3/pull/1346
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/
https://usn.ubuntu.com/3990-1/
https://security.netapp.com/advisory/ntap-20241227-0010/