python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure

🗓️ 06 Aug 2019 13:26:10Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 5 Views

urllib3 before 1.23 does not remove Authorization during cross-host redirects, risking credential exposure.

Reporter	Title	Published	Views	Family All 184
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Automation is vulnerable to multiple security vulnerabilites	27 Mar 202617:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities	3 May 202419:55	–	ibm
Tenable Nessus	Amazon Linux 2 : python-urllib3 (ALAS-2019-1211)	21 May 201900:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-virtualenv (ALAS-2020-1413)	24 Apr 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : python-urllib3 (ALAS-2019-1224)	14 Jun 201900:00	–	nessus
Tenable Nessus	CentOS 8 : python27:2.7 (CESA-2020:1605)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 8 : python-pip (CESA-2020:1916)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : python-urllib3 (CESA-2019:2272)	30 Aug 201900:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	noarch	python-urllib3	1.10.2-7.el7	python-urllib3-1.10.2-7.el7.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2018-20060
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-20060
cve	www.cve.org/CVERecord

26 Feb 2026 20:44Current

7.3High risk

Vulners AI Score7.3

CVSS 25

CVSS 39.8

EPSS0.04488

urllib3 cross host redirects authorization header credential exposure version 1.23