CVE-2023-43804 `Cookie` HTTP header isn't stripped on cross-origin redirects
Attackers can steal cookies via cross-origin redirects if users manually set Cookie headers without disabling redirects in urllib3.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-43804?
CVE-2023-43804 is a medium-severity vulnerability in Debian Debian Linux, published on 4 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Weakness: CWE-200
Which versions are affected by CVE-2023-43804?
5 open source packages ship an affected version, including urllib3. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
urllib3 PyPI | All versions | 1.26.17 |
urllib3 PyPI | All versions | 1.26.17 |
urllib3 PyPI | From 2.0.0 | 2.0.6, 1.26.17 |
urllib3 PyPI | From 2.0.0 | 2.0.6 |
urllib3 PyPI | From 2.0.0 | 2.0.6 |
Linux distribution packages (25)
python3.11-urllib3 AlmaLinux:8 | All versions | 1.26.12-2.el8 |
python3.11-urllib3 AlmaLinux:9 | All versions | 1.26.12-2.el9 |
python3.11-urllib3 Red Hat:enterprise_linux:8::appstream | All versions | 0:1.26.12-2.el8 |
python3.11-urllib3 Red Hat:enterprise_linux:9::appstream | All versions | 0:1.26.12-2.el9 |
python-urllib3 Red Hat:openstack:17.1::el8 | All versions | 0:1.25.10-5.el8ost |
python3-urllib3 Red Hat:openstack:17.1::el8 | All versions | 0:1.25.10-5.el8ost |
python3.11-urllib3 Rocky Linux:8 | All versions | 0:1.26.12-2.el8 |
python-urllib3 SUSE:HPE Helion OpenStack 8 | All versions | 1.25.10-5.22.1 |
python-urllib3 SUSE:Linux Enterprise Micro 5.1 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:Linux Enterprise Micro 5.2 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:Linux Enterprise Micro 5.3 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:Linux Enterprise Micro 5.4 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:Linux Enterprise Micro 5.5 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 1.25.10-3.34.1 |
python-urllib3 SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.25.10-3.34.1 |
python-urllib3 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.25.10-3.34.1 |
python-urllib3 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.25.10-3.34.1 |
python-urllib3 SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 1.25.10-3.34.1 |
python-urllib3 SUSE:Manager Proxy 4.2 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:Manager Server 4.2 | All versions | 1.25.10-150300.4.6.1 |
python-urllib3 SUSE:OpenStack Cloud 8 | All versions | 1.25.10-5.22.1 |
python-urllib3 SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.25.10-5.22.1 |
python-urllib3 openSUSE:Tumbleweed | All versions | 2.0.6-1.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Python Urllib3.
How do I fix CVE-2023-43804?
Upgrade urllib3 to a fixed version for your release line: 1.26.17 or 2.0.6.
Is CVE-2023-43804 being exploited?
There is no known exploitation of CVE-2023-43804 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2023-43804, ALSA-2024:2159, ALSA-2024:2986, AZL-31108, AZL-35444, AZL-59696 and 21 more.