python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure

🗓️ 17 Mar 2020 16:38:31Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 5 Views

The library fails to remove the Authorization header on origin redirects exposing credentials.

Reporter	Title	Published	Views	Family All 185
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Automation is vulnerable to multiple security vulnerabilites	27 Mar 202617:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities	3 May 202419:55	–	ibm
Tenable Nessus	Amazon Linux 2 : python-urllib3 (ALAS-2019-1211)	21 May 201900:00	–	nessus
Tenable Nessus	Amazon Linux 2 : python-virtualenv (ALAS-2020-1413)	24 Apr 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : python-urllib3 (ALAS-2019-1224)	14 Jun 201900:00	–	nessus
Tenable Nessus	CentOS 8 : python27:2.7 (CESA-2020:1605)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 8 : python-pip (CESA-2020:1916)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : python-urllib3 (CESA-2019:2272)	30 Aug 201900:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	any	python-virtualenv	0:15.1.0-4.el7_7	python-virtualenv-0:15.1.0-4.el7_7.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2018-20060
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-20060
cve	www.cve.org/CVERecord

26 Feb 2026 20:45Current

7.3High risk

Vulners AI Score7.3

CVSS 25

CVSS 39.8

EPSS0.04488

cross origin redirects authorization header credential exposure legacy versions python library