PublicDateAtUSN: 2018-12-11
Candidate: CVE-2018-20060
PublicDate: 2018-12-11 17:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20060
 https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
 https://ubuntu.com/security/notices/USN-3990-1
Description:
 urllib3 before version 1.23 does not remove the Authorization HTTP header
 when following a cross-origin redirect (i.e., a redirect that differs in
 host, port, or scheme). This can allow for credentials in the Authorization
 header to be exposed to unintended hosts or transmitted in cleartext.
Ubuntu-Description:
Notes:
Bugs:
 https://github.com/urllib3/urllib3/issues/1316
 https://bugzilla.redhat.com/show_bug.cgi?id=1649153
Priority: low
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]


Patches_python-urllib3:
 upstream: https://github.com/urllib3/urllib3/pull/1346
 upstream: https://github.com/urllib3/urllib3/commit/3d7f98b07b6e6e04c2e89cdf5afb18024a2d804c
 upstream: https://github.com/urllib3/urllib3/commit/f99912beeaf230ee3634b938d3ea426ffd1f3e57
 upstream: https://github.com/urllib3/urllib3/commit/48dba048081dfcb999afcda715d17147aa15b6ea
 upstream: https://github.com/urllib3/urllib3/commit/23e2eb56af23db5a1eeb8ad9b51dd99a27c15522
 upstream: https://github.com/urllib3/urllib3/commit/5e9c6b9175d66170ef65fc703f2e46788a59ca0c
 upstream: https://github.com/urllib3/urllib3/commit/9c9dd6f3014e89bb9c532b641abcf1b24c3896ab
 upstream: https://github.com/urllib3/urllib3/commit/6245ddddb7f80740c5c15e1750e5b9f68c5b2b5f
 upstream: https://github.com/urllib3/urllib3/commit/3b5f27449e153ad05186beca8fbd9b134936fe50
 upstream: https://github.com/urllib3/urllib3/commit/1742538d57865e61125c6c12a755b5db41636fe7
 upstream: https://github.com/urllib3/urllib3/commit/2a42e70ff077006d5a6da92251ddbb2939303f94
 upstream: https://github.com/urllib3/urllib3/commit/e8a727a0b8389f5f75981858a8bbb319646f4450
 upstream: https://github.com/urllib3/urllib3/commit/63948f3a607ed8e7a3ce9ac4e20782359896e27e
upstream_python-urllib3: released (1.24-1)
precise/esm_python-urllib3: DNE
trusty_python-urllib3: ignored (reached end-of-life)
trusty/esm_python-urllib3: needed
xenial_python-urllib3: released (1.13.1-2ubuntu0.16.04.3)
esm-infra/xenial_python-urllib3: released (1.13.1-2ubuntu0.16.04.3)
bionic_python-urllib3: released (1.22-1ubuntu0.18.04.1)
cosmic_python-urllib3: released (1.22-1ubuntu0.18.10.1)
disco_python-urllib3: not-affected (1.24-1)
eoan_python-urllib3: not-affected (1.24-1)
focal_python-urllib3: not-affected (1.24-1)
groovy_python-urllib3: not-affected (1.24-1)
hirsute_python-urllib3: not-affected (1.24-1)
impish_python-urllib3: not-affected (1.24-1)
jammy_python-urllib3: not-affected (1.24-1)
devel_python-urllib3: not-affected (1.24-1)