CVE-2018-20060 Exposure of Sensitive Information to an Unauthorized Actor in urllib3
Attackers can steal Authorization headers via cross-origin redirects in urllib3, exposing credentials to unintended hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20060?
CVE-2018-20060 is a critical vulnerability in Fedoraproject Fedora, published on 11 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Which versions are affected by CVE-2018-20060?
3 open source packages ship an affected version, including urllib3. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
urllib3 PyPI | All versions | 1.23 |
urllib3 PyPI | All versions | 1.23 |
urllib3 PyPI | All versions | 1.23 |
Products include Fedoraproject Fedora, Python Urllib3.
How do I fix CVE-2018-20060?
Upgrade urllib3 to 1.23 or later.
Is CVE-2018-20060 being exploited?
There is no known exploitation of CVE-2018-20060 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2018-20060, GHSA-www2-v7xj-xrc6, MINI-jh32-6xj9-62q4, PYSEC-2018-32, ROOT-APP-PYPI-CVE-2018-20060, UBUNTU-CVE-2018-20060.