CVE-2024-37891
published 2024-06-17CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.14%
63.1th percentile
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | python-urllib3 | < python-urllib3 1.26.12-1+deb12u1 (bookworm) | python-urllib3 1.26.12-1+deb12u1 (bookworm) |
| msrc | azl3_mozjs_102.15.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-pip_24.2-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-urllib3_2.0.7-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.3-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python-urllib3_1.26.18-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-urllib3_1.26.19-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-virtualenv_20.26.6-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| python | urllib3 | < 1.26.19 | 1.26.19 |
| python | urllib3 | >= 2.0.0 < 2.2.2 | 2.2.2 |
| urllib3 | urllib3 | < 1.26.19 | 1.26.19 |
| urllib3 | urllib3 | — | — |
| urllib3 | urllib3 | >= 0 < 1.26.19 | 1.26.19 |
| urllib3 | urllib3 | >= 2.0.0 < 2.2.2 | 2.2.2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv6.5MEDIUM
vendor_debian4.4MEDIUM
vendor_msrc4.4MEDIUM
vendor_oracle4.4MEDIUM
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Risk Matrix: Platform (urllib3) — CVE-2024-37891
vendor_oracle·2025-07-15·CVSS 4.4
CVE-2024-37891 [MEDIUM] Oracle Oracle Communications Risk Matrix: Platform (urllib3) — CVE-2024-37891
Oracle Oracle Communications Risk Matrix: Platform (urllib3) vulnerability
CVE: CVE-2024-37891
CVSS: 4.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2025 (JUL 2025)
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (urllib3) — CVE-2024-37891
vendor_oracle·2025-04-15·CVSS 4.4
CVE-2024-37891 [MEDIUM] Oracle Oracle Communications Risk Matrix: Configuration (urllib3) — CVE-2024-37891
Oracle Oracle Communications Risk Matrix: Configuration (urllib3) vulnerability
CVE: CVE-2024-37891
CVSS: 4.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Billing Care (urllib3) — CVE-2024-37891
vendor_oracle·2025-01-15·CVSS 4.4
CVE-2024-37891 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Billing Care (urllib3) — CVE-2024-37891
Oracle Oracle Communications Applications Risk Matrix: Billing Care (urllib3) vulnerability
CVE: CVE-2024-37891
CVSS: 4.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Ubuntu
pip vulnerability
vendor_ubuntu·2024-10-30
CVE-2024-37891 pip vulnerability
Title: pip vulnerability
Summary: urllib3 could leak sensitive information.
USN-7084-1 fixed vulnerability in urllib3. This update provides the
corresponding update for the urllib3 module bundled into pip.
Original advisory details:
It was discovered that urllib3 didn't strip HTTP Proxy-Authorization
header on cross-origin redirects. A remote attacker could possibly use
this issue to obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
urllib3 vulnerability
vendor_ubuntu·2024-10-29
CVE-2024-37891 urllib3 vulnerability
Title: urllib3 vulnerability
Summary: urllib3 could leak sensitive information.
It was discovered that urllib3 didn't strip HTTP Proxy-Authorization header
on cross-origin redirects. A remote attacker could possibly use this issue
to obtain sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Risk Matrix: Alarms, KPI, and Measurements (urllib3) — CVE-2024-37891
vendor_oracle·2024-10-15·CVSS 4.4
CVE-2024-37891 [MEDIUM] Oracle Oracle Communications Risk Matrix: Alarms, KPI, and Measurements (urllib3) — CVE-2024-37891
Oracle Oracle Communications Risk Matrix: Alarms, KPI, and Measurements (urllib3) vulnerability
CVE: CVE-2024-37891
CVSS: 4.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Red Hat
urllib3: proxy-authorization request header is not stripped during cross-origin redirects
vendor_redhat·2024-06-17·CVSS 4.4
CVE-2024-37891 [MEDIUM] CWE-669 urllib3: proxy-authorization request header is not stripped during cross-origin redirects
urllib3: proxy-authorization request header is not stripped during cross-origin redirects
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this v
Microsoft
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
vendor_msrc·2024-06-11·CVSS 4.4
CVE-2024-37891 [MEDIUM] CWE-669 Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-M
Debian
CVE-2024-37891: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. When using urllib3's ...
vendor_debian·2024·CVSS 4.4
CVE-2024-37891 [MEDIUM] CVE-2024-37891: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. When using urllib3's ...
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will autom
OSV
CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python
osv·2024-06-17·CVSS 6.5
CVE-2024-37891 [MEDIUM] CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will autom
GHSA
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
ghsa·2024-06-17
CVE-2024-37891 [MEDIUM] CWE-669 urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.
Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abund
OSV
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
osv·2024-06-17
CVE-2024-37891 [MEDIUM] urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.
Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abund
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-37891 urllib3: proxy-authorization request header is not stripped during cross-origin redirects
bugzilla·2024-06-17·CVSS 6.5
CVE-2024-37891 [MEDIUM] CVE-2024-37891 urllib3: proxy-authorization request header is not stripped during cross-origin redirects
CVE-2024-37891 urllib3: proxy-authorization request header is not stripped during cross-origin redirects
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.
Because this is a highly unlikely scenario, we believe the seve
arXiv
PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python
arxiv_fulltext·2025-07-24
PyPitfall: Dependency Chaos and Software Supply Chain Vulnerabilities in Python
system
systems
System
Systems
system
systems
[1] [
= #1 . #1 .
= #1 ]
[1] (
= #1 . #1 .
= #1 )
: Dependency Chaos and Software Supply Chain Vulnerabilities in Python
Jacob Mahon
Computer Science Department
New Jersey Institute of Technology
Newark, New Jersey, USA
[email protected]
Chenxi Hou
Computer Science Department
New Jersey Institute of Technology
Newark, New Jersey, USA
[email protected]
Zhihao Yao
Computer Science Department
New Jersey Institute of Technology
Newark, New Jersey, USA
[email protected]
## Abstract
Python software development heavily relies on third-party packages. Direct and transitive dependencies create a labyrinth of software supply chains. While it is convenient to reuse code, vulnerabilities within these dependency chains can propagate through depe
https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270ehttps://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxfhttps://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270ehttps://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxfhttps://lists.debian.org/debian-lts-announce/2024/12/msg00020.htmlhttps://security.netapp.com/advisory/ntap-20240822-0003/https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891
2024-06-17
Published