Bug 2244340 (CVE-2018-25091)
| Summary: | CVE-2018-25091 urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Avinash Hanwate <ahanwate> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | adudiak, apevec, bbuckingham, bcourt, bdettelb, code, cstratak, davidn, dfreiber, eglynn, ehelms, epacific, hhorak, jburrell, jcammara, jchui, jhardy, jjoyce, jkoehler, jneedle, jobarker, jorton, jschluet, jsherril, kshier, ktsao, lhh, lzap, mabashia, mburns, mgarciac, mhulan, nboldt, nmoumoul, orabin, osapryki, pcreech, pgrist, python-maint, rchan, rhos-maint, rogbas, saroy, simaishi, smcdonal, stcannon, teagle, tfister, torsava, tsweeney, vkumar, yguenane, zsadeh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | urllib3 1.24.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the urllib3 package. Affected versions of this package are vulnerable to information exposure through sent data when the authorization HTTP header is not removed during a cross-origin redirect. An attacker can expose credentials in the authorization header to unintended hosts or transmit them in clear text by exploiting the incomplete fix for CVE-2018-20060.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2244593, 2246489, 2246499, 2246520, 2246521, 2246540 | ||
| Bug Blocks: | 2242490 | ||
|
Description
Avinash Hanwate
2023-10-16 04:07:43 UTC
Created ansible-lint tracking bugs for this issue: Affects: fedora-all [bug 2246497] Created cura tracking bugs for this issue: Affects: fedora-all [bug 2246498] Created docker-compose tracking bugs for this issue: Affects: epel-all [bug 2246490] Created duplicity tracking bugs for this issue: Affects: epel-all [bug 2246491] Created mingw-python-urllib3 tracking bugs for this issue: Affects: fedora-all [bug 2246520] Created mote tracking bugs for this issue: Affects: epel-all [bug 2246492] Created ndiscover-exo-2-fonts tracking bugs for this issue: Affects: fedora-all [bug 2246500] Created oci-cli tracking bugs for this issue: Affects: fedora-all [bug 2246501] Created offlineimap tracking bugs for this issue: Affects: fedora-all [bug 2246502] Created pipenv tracking bugs for this issue: Affects: fedora-all [bug 2246503] Created pypy tracking bugs for this issue: Affects: fedora-all [bug 2246504] Created python-WSGIProxy2 tracking bugs for this issue: Affects: fedora-all [bug 2246505] Created python-ansible-compat tracking bugs for this issue: Affects: fedora-all [bug 2246506] Created python-dbus-next tracking bugs for this issue: Affects: fedora-all [bug 2246507] Created python-docker tracking bugs for this issue: Affects: epel-all [bug 2246493] Affects: openstack-rdo [bug 2246519] Created python-ffmpeg-python tracking bugs for this issue: Affects: fedora-all [bug 2246508] Created python-flake8-builtins tracking bugs for this issue: Affects: fedora-all [bug 2246509] Created python-hvac tracking bugs for this issue: Affects: epel-all [bug 2246494] Affects: fedora-all [bug 2246510] Created python-molecule tracking bugs for this issue: Affects: fedora-all [bug 2246511] Created python-pip tracking bugs for this issue: Affects: fedora-all [bug 2246513] Created python-play-scraper tracking bugs for this issue: Affects: fedora-all [bug 2246514] Created python-pygments-better-html tracking bugs for this issue: Affects: fedora-all [bug 2246515] Created python-smart-gardena tracking bugs for this issue: Affects: epel-all [bug 2246495] Created python-urllib3 tracking bugs for this issue: Affects: fedora-all [bug 2246489] Affects: openstack-rdo [bug 2246521] Created python-zuul-client tracking bugs for this issue: Affects: fedora-all [bug 2246516] Created python38-hvac tracking bugs for this issue: Affects: epel-all [bug 2246496] Created sorkintype-merriweather-fonts tracking bugs for this issue: Affects: fedora-all [bug 2246517] Created sorkintype-merriweather-sans-fonts tracking bugs for this issue: Affects: fedora-all [bug 2246518] Why open a tracking bug for such an old urllib3 version? Only python2-urllib3 in RHEL7 is old enough to be potentially affected. Fedora moved on long ago. And what’s the logic behind the additional packages that had bugs filed? I can’t seem to find a pattern. As far as I can tell, they don’t all bundle urllib3, or even all seem to depend on it. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:2988 https://access.redhat.com/errata/RHSA-2024:2988 |