Skip to content
Fencer Vulns
medium 4.2

CVE-2023-45803 json

Request body not stripped after redirect in urllib3

published 2023-10-17 3 y ago modified 2026-09-10 1 mo ago also GHSA-g4mx-q9vg-27p4 , PYSEC-2023-212 , EUVD-2023-0254

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.

Patch / fix

  • pypi urllib3 1.26.18, 2.0.7
  • python urllib3 1.26.18, 2.0.7
  • python-urllib3 Debian 12 1.26.12-1+deb12u1
  • python-urllib3 Debian 14, Debian 13 1.26.18-1

debian advisories DEBIAN-CVE-2023-45803

  • python-pip Ubuntu 20.04 LTS 20.0.2-5ubuntu1.10
  • python-pip Ubuntu 22.04 LTS 22.0.2+dfsg-1ubuntu0.4
  • python-pip Ubuntu 24.04 LTS 24.0+dfsg-1ubuntu1.3
  • python-urllib3 Ubuntu 20.04 LTS 1.25.8-2ubuntu0.3
  • python-urllib3 Ubuntu 22.04 LTS 1.26.5-1~exp1ubuntu0.1
  • python-pip Ubuntu Pro 16.04 LTS 8.1.1-2ubuntu0.6+esm6
  • python-pip Ubuntu Pro 18.04 LTS 9.0.1-2.3~ubuntu1.18.04.8+esm2
  • python-urllib3 Ubuntu Pro 16.04 LTS 1.13.1-2ubuntu0.16.04.4+esm1

ubuntu advisories UBUNTU-CVE-2023-45803

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • fence-agents RHEL 9 4.10.0-55.el9_3.3
  • fence-virt RHEL 9 4.10.0-55.el9_3.3
  • fence-virtd RHEL 9 4.10.0-55.el9_3.3
  • fence-virtd-cpg RHEL 9 4.10.0-55.el9_3.3
  • fence-virtd-tcp RHEL 9 4.10.0-55.el9_3.3
  • fence-agents-all RHEL 9 4.10.0-55.el9_3.3
  • fence-agents-apc RHEL 9 4.10.0-55.el9_3.3
  • fence-agents-aws RHEL 9 4.10.0-55.el9_3.3

red hat advisories RHBA-2024:1420RHBA-2024:1137RHBA-2024:1398RHBA-2024:1114RHBA-2024:1091RHSA-2025:1813

  • python-urllib3 SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, SLE Micro 5.5 +10 more 1.25.10-150300.4.9.1
  • python-urllib3 SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +2 more 1.25.10-3.37.1
  • python-urllib3 OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.25.10-5.25.1
  • python-urllib3 OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.23-3.25.1

suse advisories SUSE-SU-2024:2462-1SUSE-SU-2023:4468-1SUSE-SU-2023:4467-1SUSE-SU-2023:4356-1SUSE-SU-2023:4352-1

  • python-urllib3 openSUSE Tumbleweed 2.8.0-1.1
  • python-urllib3_1 openSUSE Tumbleweed 1.26.20-7.2
  • python-urllib3 openSUSE Tumbleweed 2.0.7-1.1

opensuse advisories openSUSE-SU-2026:12044-1openSUSE-SU-2026:12045-1openSUSE-SU-2024:13343-1

  • python3.11-urllib3 AlmaLinux 8 1.26.12-5.el8_10
  • python3.11-urllib3 AlmaLinux 9 1.26.12-2.el9_5.2
  • resource-agents AlmaLinux 8 4.9.0-54.el8
  • resource-agents-gcp AlmaLinux 8 4.9.0-54.el8
  • resource-agents-paf AlmaLinux 8 4.9.0-54.el8
  • resource-agents-aliyun AlmaLinux 8 4.9.0-54.el8
  • fence-agents-all AlmaLinux 8 4.2.1-129.el8
  • fence-agents-apc AlmaLinux 8 4.2.1-129.el8

almalinux advisories ALSA-2024:11189ALSA-2024:11238ALSA-2024:2952ALSA-2024:2968ALSA-2024:2132ALSA-2024:0464

  • resource-agents Rocky Linux 8 4.9.0-54.el8
  • python3.11-urllib3 Rocky Linux 8 1.26.12-5.el8_10
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1825+623b0c20
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1843+6892ab28
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1872+2e18eb19
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1874+ce489889
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1880+8e896d1b

rocky linux advisories RLSA-2024:2952RLSA-2024:11189RLSA-2024:2988RLSA-2024:11238RLSA-2024:2968

  • py3-urllib3 Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 1.26.18-r0

alpine advisories ALPINE-CVE-2023-45803

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-urllib3 CBL-Mariner 2.0 1.26.18-1
  • python-urllib3 Azure Linux 3.0 2.0.7-1
  • python-pip Azure Linux 3.0 24.2-1
  • python3 CBL-Mariner 2.0 3.9.19-14

azure linux advisories AZL-31615AZL-35445AZL-35785AZL-59705

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45803 updated cvss 4.2

urllib3: Request body not stripped after redirect from 303 status changes request method to GET

  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-baremetal-container
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 python-urllib3 Red Hat Enterprise Linux 7 python-pip, python3-pip, python-urllib3, resource-agents, python-s3transfer, resource-agents-gcp, +5 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 python-pip, python3-pip, python3-pip-wheel, platform-python-pip Red Hat Enterprise Linux 9 python-pip, python3-pip, python3-pip-wheel
    affected: workaround, no fix available
  • Red Hat OpenShift Data Science (RHODS) python-urllib3, rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-ml-pipelines-api-server-rhel8, rhods/odh-ml-pipelines-artifact-manager-rhel8, rhods/odh-ml-pipelines-persistenceagent-rhel8, rhods/odh-ml-pipelines-viewercontroller-rhel8, +1 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Quay 3 python-urllib3, quay/quay-rhel8
    affected: workaround, no fix available
  • Red Hat Software Collections rh-python38-python-pip, rh-python38-python-urllib3, rh-python38-python-pip-wheel Red Hat Storage 3 graphite-web, python-urllib3, python2-urllib3
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9 Red Hat OpenStack Platform 10 (Newton) python-urllib3 Red Hat OpenStack Platform 13 (Queens) python2-urllib3 Red Hat OpenStack Platform 15 (Stein) python3-urllib3
    under investigation
  • Red Hat Enterprise Linux AppStream (v. 8) fence-agents 4.2.1-129.el8, fence-agents 4.2.1-121.el8_9.4, fence-agents-all 4.2.1-129.el8, fence-agents-apc 4.2.1-129.el8, fence-agents-eps 4.2.1-129.el8, fence-agents-rsa 4.2.1-129.el8, +114 more
    fixed: vendor fix RHSA-2024:2988
show 24 more
  • Red Hat Enterprise Linux AppStream (v. 9) fence-virt 4.10.0-62.el9, fence-virtd 4.10.0-62.el9, fence-agents 4.10.0-62.el9, fence-virt 4.10.0-55.el9_3.3, fence-virtd 4.10.0-55.el9_3.3, fence-virtd-cpg 4.10.0-62.el9, +23 more
    fixed: vendor fix RHBA-2024:1137
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents 4.2.1-65.el8_4.14, fence-agents-all 4.2.1-65.el8_4.14, fence-agents-apc 4.2.1-65.el8_4.14, fence-agents-eps 4.2.1-65.el8_4.14, fence-agents-rsa 4.2.1-65.el8_4.14, fence-agents-rsb 4.2.1-65.el8_4.14, +36 more Red Hat Enterprise Linux AppStream E4S (v.8.4) fence-agents 4.2.1-65.el8_4.14, fence-agents-all 4.2.1-65.el8_4.14, fence-agents-apc 4.2.1-65.el8_4.14, fence-agents-eps 4.2.1-65.el8_4.14, fence-agents-rsa 4.2.1-65.el8_4.14, fence-agents-rsb 4.2.1-65.el8_4.14, +36 more
    fixed: vendor fix RHBA-2024:1398
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) fence-agents 4.2.1-89.el8_6.11, fence-agents-all 4.2.1-89.el8_6.11, fence-agents-apc 4.2.1-89.el8_6.11, fence-agents-eps 4.2.1-89.el8_6.11, fence-agents-rsa 4.2.1-89.el8_6.11, fence-agents-rsb 4.2.1-89.el8_6.11, +37 more
    fixed: vendor fix RHBA-2024:1114
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) python3.11-urllib3 1.26.12-1.el8_8.2
    fixed: vendor fix RHSA-2025:0078
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) fence-virt 4.10.0-20.el9_0.11, fence-virtd 4.10.0-20.el9_0.11, fence-agents 4.10.0-20.el9_0.11, fence-virtd-cpg 4.10.0-20.el9_0.11, fence-virtd-tcp 4.10.0-20.el9_0.11, fence-agents-virsh 4.10.0-20.el9_0.11, +9 more
    fixed: vendor fix RHSA-2024:1155
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) fence-virt 4.10.0-43.el9_2.3, fence-virtd 4.10.0-43.el9_2.3, fence-agents 4.10.0-43.el9_2.3, fence-virtd-cpg 4.10.0-43.el9_2.3, fence-virtd-tcp 4.10.0-43.el9_2.3, fence-agents-virsh 4.10.0-43.el9_2.3, +9 more
    fixed: vendor fix RHBA-2024:1091
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.11-urllib3 1.26.12-2.el9_4.2
    fixed: vendor fix RHSA-2025:1793
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) fence-agents 4.2.1-65.el8_4.14, fence-agents-all 4.2.1-65.el8_4.14, fence-agents-apc 4.2.1-65.el8_4.14, fence-agents-eps 4.2.1-65.el8_4.14, fence-agents-rsa 4.2.1-65.el8_4.14, fence-agents-rsb 4.2.1-65.el8_4.14, +36 more
    fixed: vendor fix RHBA-2024:1398
  • Red Hat Enterprise Linux BaseOS (v. 8) python-urllib3 1.24.2-5.el8_9.2, python3-urllib3 1.24.2-5.el8_9.2
    fixed: vendor fix RHSA-2024:0116
  • Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3 1.26.5-3.el9_3.1, python3-urllib3 1.26.5-3.el9_3.1
    fixed: vendor fix RHSA-2024:0464
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) python-urllib3 1.24.2-5.el8_6.1, python3-urllib3 1.24.2-5.el8_6.1
    fixed: vendor fix RHSA-2024:0300
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) python-urllib3 1.24.2-5.el8_8.1, python3-urllib3 1.24.2-5.el8_8.1
    fixed: vendor fix RHSA-2024:0588
  • Red Hat Enterprise Linux High Availability (v. 8) fence-agents-aws 4.2.1-121.el8_9.4, fence-agents-gce 4.2.1-121.el8_9.4, fence-agents-aliyun 4.2.1-121.el8_9.4, fence-agents-azure-arm 4.2.1-121.el8_9.4, fence-agents-openstack 4.2.1-121.el8_9.4
    fixed: vendor fix RHBA-2024:0891
  • Red Hat Enterprise Linux High Availability (v. 9) fence-agents-all 4.10.0-55.el9_3.3, fence-agents-apc 4.10.0-55.el9_3.3, fence-agents-aws 4.10.0-55.el9_3.3, fence-agents-eps 4.10.0-55.el9_3.3, fence-agents-gce 4.10.0-55.el9_3.3, fence-agents-rsa 4.10.0-55.el9_3.3, +36 more
    fixed: vendor fix RHBA-2024:1137
  • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aws 4.2.1-65.el8_4.14, fence-agents-gce 4.2.1-65.el8_4.14, fence-agents-aliyun 4.2.1-65.el8_4.14, fence-agents-azure-arm 4.2.1-65.el8_4.14
    fixed: vendor fix RHBA-2024:1398
  • Red Hat Enterprise Linux High Availability EUS (v.8.6) fence-agents-aws 4.2.1-89.el8_6.11, fence-agents-gce 4.2.1-89.el8_6.11, fence-agents-aliyun 4.2.1-89.el8_6.11, fence-agents-azure-arm 4.2.1-89.el8_6.11
    fixed: vendor fix RHBA-2024:1114
  • Red Hat Enterprise Linux High Availability EUS (v.8.8) resource-agents 4.9.0-40.el8_8.2, resource-agents-gcp 4.9.0-40.el8_8.2, resource-agents-paf 4.9.0-40.el8_8.2, resource-agents-aliyun 4.9.0-40.el8_8.2
    fixed: vendor fix RHBA-2024:1420
  • Red Hat Enterprise Linux High Availability EUS (v.9.0) fence-agents-all 4.10.0-20.el9_0.11, fence-agents-apc 4.10.0-20.el9_0.11, fence-agents-aws 4.10.0-20.el9_0.11, fence-agents-eps 4.10.0-20.el9_0.11, fence-agents-gce 4.10.0-20.el9_0.11, fence-agents-rsa 4.10.0-20.el9_0.11, +36 more
    fixed: vendor fix RHSA-2024:1155
  • Red Hat Enterprise Linux High Availability EUS (v.9.2) fence-agents-all 4.10.0-43.el9_2.3, fence-agents-apc 4.10.0-43.el9_2.3, fence-agents-aws 4.10.0-43.el9_2.3, fence-agents-eps 4.10.0-43.el9_2.3, fence-agents-gce 4.10.0-43.el9_2.3, fence-agents-rsa 4.10.0-43.el9_2.3, +36 more
    fixed: vendor fix RHBA-2024:1091
  • Red Hat Enterprise Linux HighAvailability (v. 8) resource-agents 4.9.0-54.el8, fence-agents-aws 4.2.1-129.el8, fence-agents-gce 4.2.1-129.el8, resource-agents-gcp 4.9.0-54.el8, resource-agents-paf 4.9.0-54.el8, fence-agents-aliyun 4.2.1-129.el8, +3 more
    fixed: vendor fix RHSA-2024:2968
  • Red Hat Enterprise Linux HighAvailability (v. 9) fence-agents-all 4.10.0-62.el9, fence-agents-apc 4.10.0-62.el9, fence-agents-aws 4.10.0-62.el9, fence-agents-eps 4.10.0-62.el9, fence-agents-gce 4.10.0-62.el9, fence-agents-rsa 4.10.0-62.el9, +36 more
    fixed: vendor fix RHSA-2024:2132
  • Red Hat Enterprise Linux HighAvailability E4S (v.8.4) fence-agents-aws 4.2.1-65.el8_4.14, fence-agents-gce 4.2.1-65.el8_4.14, fence-agents-aliyun 4.2.1-65.el8_4.14, fence-agents-azure-arm 4.2.1-65.el8_4.14 Red Hat Enterprise Linux HighAvailability TUS (v.8.4) fence-agents-aws 4.2.1-65.el8_4.14, fence-agents-gce 4.2.1-65.el8_4.14, fence-agents-aliyun 4.2.1-65.el8_4.14, fence-agents-azure-arm 4.2.1-65.el8_4.14
    fixed: vendor fix RHBA-2024:1398
  • Red Hat Enterprise Linux Resilient Storage (v. 8) fence-agents-aws 4.2.1-121.el8_9.4, fence-agents-gce 4.2.1-121.el8_9.4, fence-agents-aliyun 4.2.1-121.el8_9.4, fence-agents-azure-arm 4.2.1-121.el8_9.4, fence-agents-openstack 4.2.1-121.el8_9.4
    fixed: vendor fix RHBA-2024:0891
  • Red Hat Enterprise Linux Resilient Storage (v. 9) fence-agents-all 4.10.0-55.el9_3.3, fence-agents-apc 4.10.0-55.el9_3.3, fence-agents-aws 4.10.0-55.el9_3.3, fence-agents-eps 4.10.0-55.el9_3.3, fence-agents-gce 4.10.0-55.el9_3.3, fence-agents-rsa 4.10.0-55.el9_3.3, +36 more
    fixed: vendor fix RHBA-2024:1137

9 more fixed, 8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi urllib3
>=2.0.0, <2.0.7
<1.26.18
2.0.7
1.26.18

Affected products

  • urllib3 urllib3

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.