CVE-2018-25091

2023-10-1500:00:00

ubuntu.com

urllib3

authorization header

cve-2018-25091

cross-origin redirect

cleartext

incomplete fix

case-sensitive

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.01 Low

EPSS

Percentile

83.8%

JSON

urllib3 before 1.24.2 does not remove the authorization HTTP header when
following a cross-origin redirect (i.e., a redirect that differs in host,
port, or scheme). This can allow for credentials in the authorization
header to be exposed to unintended hosts or transmitted in cleartext. NOTE:
this issue exists because of an incomplete fix for CVE-2018-20060 (which
was case-sensitive).

Notes

Author	Note
mdeslaur	On focal and earlier, the python-pip package bundles python-urllib3 binaries when built. After updating python-urllib3, a no-change rebuild of python-pip is required. On jammy and later, python-urllib3 is bundled in the python-pip package and needs to be patched.
sbeattie	According to Debian, this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive)

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpython-pip< 9.0.1-2.3~ubuntu1.18.04.8+esm2UNKNOWN
ubuntu20.04noarchpython-pip< 20.0.2-5ubuntu1.10UNKNOWN
ubuntu22.04noarchpython-pip< 22.0.2+dfsg-1ubuntu0.4UNKNOWN
ubuntu23.04noarchpython-pip< 23.0.1+dfsg-1ubuntu0.2UNKNOWN
ubuntu23.10noarchpython-pip< 23.2+dfsg-1ubuntu0.1UNKNOWN
ubuntu24.04noarchpython-pip< anyUNKNOWN
ubuntu14.04noarchpython-pip< anyUNKNOWN
ubuntu16.04noarchpython-pip< 8.1.1-2ubuntu0.6+esm6UNKNOWN
ubuntu18.04noarchpython-urllib3< 1.22-1ubuntu0.18.04.2+esm1UNKNOWN
ubuntu14.04noarchpython-urllib3< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	python-pip	< 9.0.1-2.3~ubuntu1.18.04.8+esm2	UNKNOWN
ubuntu	20.04	noarch	python-pip	< 20.0.2-5ubuntu1.10	UNKNOWN
ubuntu	22.04	noarch	python-pip	< 22.0.2+dfsg-1ubuntu0.4	UNKNOWN
ubuntu	23.04	noarch	python-pip	< 23.0.1+dfsg-1ubuntu0.2	UNKNOWN
ubuntu	23.10	noarch	python-pip	< 23.2+dfsg-1ubuntu0.1	UNKNOWN
ubuntu	24.04	noarch	python-pip	< any	UNKNOWN
ubuntu	14.04	noarch	python-pip	< any	UNKNOWN
ubuntu	16.04	noarch	python-pip	< 8.1.1-2ubuntu0.6+esm6	UNKNOWN
ubuntu	18.04	noarch	python-urllib3	< 1.22-1ubuntu0.18.04.2+esm1	UNKNOWN
ubuntu	14.04	noarch	python-urllib3	< any	UNKNOWN