https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 18:37:40 +0000 https://cve.radiocsirt.org/vuln/cve-2018-25091 <p>urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).</p> <p>urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).</p> https://cve.radiocsirt.org/vuln/cve-2018-25091 https://cve.radiocsirt.org/vuln/usn-6473-1 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:20.04:LTS: python-urllib3, Ubuntu:22.04:LTS: python-urllib3</p> <p>It was discovered that urllib3 didn&#39;t strip HTTP Authorization header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-25091)</p> <p>It was discovered that urllib3 didn&#39;t strip HTTP Cookie header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-43804)</p> <p>It was discovered that urllib3 didn&#39;t strip HTTP body on status code 303 redirects under certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-45803)</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:20.04:LTS: python-urllib3, Ubuntu:22.04:LTS: python-urllib3</p> <p>It was discovered that urllib3 didn&#39;t strip HTTP Authorization header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-25091)</p> <p>It was discovered that urllib3 didn&#39;t strip HTTP Cookie header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-43804)</p> <p>It was discovered that urllib3 didn&#39;t strip HTTP body on status code 303 redirects under certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-45803)</p> https://cve.radiocsirt.org/vuln/usn-6473-1