Authorization Header Exposure in urllib3 by Python Software Foundation

CVE-2018-25091

What is CVE-2018-25091?

In urllib3 versions prior to 1.24.2, an issue exists where the authorization HTTP header is not stripped away when following cross-origin redirects. This oversight can potentially expose sensitive credentials to unintended recipients, as the credentials may be transmitted in cleartext to a different host, port, or scheme. The problem arises from an incomplete resolution of a previous vulnerability, leading to security concerns for applications relying on urllib3 for HTTP communications.

References