Skip to content
Fencer Vulns
medium 6.1

CVE-2018-25091 json

Authorization Header forwarded on redirect

published 2023-10-15 3 y ago modified 2026-06-17 4 mo ago also GHSA-gwvm-45gx-3cf8 , PYSEC-2023-207 , EUVD-2023-0253

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

Patch / fix

  • pypi urllib3 1.24.2
  • python urllib3 1.24.2
  • python-urllib3 Debian 14, Debian 13, Debian 12 1.25.6-4

debian advisories DEBIAN-CVE-2018-25091

  • python-pip Ubuntu Pro 16.04 LTS 8.1.1-2ubuntu0.6+esm6
  • python-pip Ubuntu Pro 18.04 LTS 9.0.1-2.3~ubuntu1.18.04.8+esm2
  • python-urllib3 Ubuntu Pro 16.04 LTS 1.13.1-2ubuntu0.16.04.4+esm1
  • python-urllib3 Ubuntu Pro 18.04 LTS 1.22-1ubuntu0.18.04.2+esm1

ubuntu advisories UBUNTU-CVE-2018-25091

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • criu RHEL 8 3.18-4.module+el8.9.0+20326+387084d0
  • crun RHEL 8 1.14.3-2.module+el8.10.0+21340+c6c7475a
  • runc RHEL 8 1:1.1.12-1.module+el8.10.0+21251+62b7388c
  • udica RHEL 8 0.2.6-20.module+el8.9.0+20326+387084d0
  • conmon RHEL 8 3:2.1.10-1.module+el8.10.0+21077+98b84d8a
  • podman RHEL 8 3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
  • skopeo RHEL 8 2:1.14.3-0.1.module+el8.10.0+21251+62b7388c

red hat advisories RHSA-2024:2988

  • python-urllib3 OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.23-3.25.1

suse advisories SUSE-SU-2023:4352-1

  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1825+623b0c20
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1843+6892ab28
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1872+2e18eb19
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1874+ce489889
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1880+8e896d1b
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1896+b18fa106
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1948+4b5cd4a9

rocky linux advisories RLSA-2024:2988

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-25091 updated cvss 6.1

urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect

  • Red Hat Ansible Automation Platform 2 python-urllib3
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 6 python-urllib3 Red Hat Enterprise Linux 7 python-pip, python3-pip, python-urllib3, resource-agents, python-s3transfer, resource-agents-gcp, +5 more Red Hat OpenShift Container Platform 3.11 python-urllib3, python2-urllib3
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/baremetal-hardware-event-proxy-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-ml-pipelines-cache-rhel8 Red Hat Quay 3 quay/quay-rhel8
    affected: workaround, no fix available
  • Red Hat Storage 3 graphite-web
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-4.module+el8.9.0+20326+387084d0, criu 3.18-4.module+el8.9.0+20326+387084d0, crun 1.14.3-2.module+el8.10.0+21340+c6c7475a, runc 1.1.12-1.module+el8.10.0+21251+62b7388c, udica 0.2.6-20.module+el8.9.0+20326+387084d0, conmon 2.1.10-1.module+el8.10.0+21077+98b84d8a, +27 more
    fixed: vendor fix RHSA-2024:2988
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-baremetal-container Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 8 python-pip, python2-pip, python3-pip, python38-pip, python39-pip, python3x-pip, +9 more Red Hat Enterprise Linux 9 fence-virt, python-pip, fence-virtd, python3-pip, fence-agents, python-urllib3, +58 more Red Hat OpenShift Container Platform 4 openshift4/ztp-site-generate-rhel8 Red Hat OpenStack Platform 17.1 python-urllib3
    +2 more products
    Red Hat Satellite 6 python-urllib3, python3-urllib3, ansiblerole-foreman_scap_client Red Hat Software Collections rh-python38-python-pip, rh-python38-python-urllib3, rh-python38-python-pip-wheel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi urllib3
<1.24.2
1.24.2

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.