critique
CVE-2018-20060
python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat5.3CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Photon OS. Plus basse selon Red Hat (moyenne), AlmaLinux (moyenne), Amazon (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (faible).
Description
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | python-urllib3 | 1.26.6-1.ph1 |
| Photon OS 2.0 | python-urllib3 | 1.26.6-1.ph2 |
| pip::GitHub Security Advisory pip | urllib3 | 1.23 |
| alma 8 | python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython, python27:2.7::python2-PyMySQL et 25 autres | 2.7.5-7.module_el8.6.0+2781+fed64c13 et 23 autres |
| amazon linux 1 | python26-urllib3, python27-urllib3 | 1.24.1-1.6.amzn1 |
| amazon linux 2 | python-urllib3, python-virtualenv | 1.24.3-1.amzn2.0.1 et 1 autres |
| debian 11 | python-urllib3 | 1.24-1 |
| debian 12 | python-urllib3 | 1.24-1 |
| debian 13 | python-urllib3 | 1.24-1 |
| debian 14 | python-urllib3 | 1.24-1 |
| debian 8 | python-urllib3 | pas de correctif indiqué |
| debian 9 | python-urllib3 | 1.19.1-1+deb9u1 |
Afficher les 154 entrées de 23 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | python-urllib3 | 1.26.6-1.ph1 |
| Photon OS 2.0 | python-urllib3 | 1.26.6-1.ph2 |
| pip::GitHub Security Advisory pip | urllib3 | 1.23 |
| alma 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-Cython | 0.28.1-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-attrs | 17.4.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-chardet | 3.0.4-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-coverage | 4.5.1-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-dns | 1.15.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docs | 2.7.16-2.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docs-info | 2.7.16-2.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docutils | 0.14-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-idna | 2.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-markupsafe | 0.23-19.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-mock | 2.0.0-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pluggy | 0.6.0-8.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-py | 1.5.3-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pysocks | 1.6.8-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest | 3.4.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytz | 2017.2-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pyyaml | 3.12-16.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-requests | 2.20.0-3.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-rpm-macros | 3-38.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module_el8.6.0+2781+fed64c13 |
| amazon linux 1 | python26-urllib3 | 1.24.1-1.6.amzn1 |
| amazon linux 1 | python27-urllib3 | 1.24.1-1.6.amzn1 |
| amazon linux 2 | python-urllib3 | 1.24.3-1.amzn2.0.1 |
| amazon linux 2 | python-virtualenv | 15.1.0-4.amzn2 |
| debian 11 | python-urllib3 | 1.24-1 |
| debian 12 | python-urllib3 | 1.24-1 |
| debian 13 | python-urllib3 | 1.24-1 |
| debian 14 | python-urllib3 | 1.24-1 |
| debian 8 | python-urllib3 | pas de correctif indiqué |
| debian 9 | python-urllib3 | 1.19.1-1+deb9u1 |
| echo | python-urllib3 | 1.24-1 |
| Oracle Linux 7 | python-urllib3 | 1.10.2-7.el7 |
| Oracle Linux 7 | python-virtualenv | 15.1.0-4.el7_8 |
| Oracle Linux 7 | python3-pip | 9.0.3-7.el7_8 |
| Oracle Linux 8 | babel | 2.5.1-9.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | platform-python-pip | 9.0.3-16.el8 |
| Oracle Linux 8 | python-nose-docs | 1.3.7-30.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python-psycopg2-doc | 2.7.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python-sqlalchemy-doc | 1.3.2-1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2 | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-Cython | 0.28.1-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-PyMySQL | 0.8.0-10.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-attrs | 17.4.0-10.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-babel | 2.5.1-9.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-backports | 1.0-15.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-backports-ssl_match_hostname | 3.5.0.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-bson | 3.6.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-chardet | 3.0.4-10.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-coverage | 4.5.1-4.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-debug | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-devel | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-dns | 1.15.0-10.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-docs | 2.7.16-2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-docs-info | 2.7.16-2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-docutils | 0.14-12.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-funcsigs | 1.0.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-idna | 2.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-ipaddress | 1.0.18-6.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-jinja2 | 2.10-8.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-libs | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-lxml | 4.2.3-3.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-markupsafe | 0.23-19.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-mock | 2.0.0-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-nose | 1.3.7-30.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-numpy | 1:1.14.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-numpy-doc | 1:1.14.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-numpy-f2py | 1:1.14.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pip | 9.0.3-16.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pip-wheel | 9.0.3-16.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pluggy | 0.6.0-8.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-psycopg2 | 2.7.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-psycopg2-debug | 2.7.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-psycopg2-tests | 2.7.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-py | 1.5.3-6.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pygments | 2.2.0-20.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pymongo | 3.6.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pymongo-gridfs | 3.6.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pysocks | 1.6.8-6.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pytest | 3.4.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pytest-mock | 1.9.0-4.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pytz | 2017.2-12.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pyyaml | 3.12-16.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-requests | 2.20.0-3.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-rpm-macros | 3-38.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-scipy | 1.0.0-20.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-setuptools | 39.0.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-setuptools-wheel | 39.0.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-setuptools_scm | 1.15.7-6.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-six | 1.11.0-5.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-sqlalchemy | 1.3.2-1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-test | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-tkinter | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-tools | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-urllib3 | 1.24.2-1.0.2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-virtualenv | 15.1.0-19.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-wheel | 1:0.31.1-2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-wheel-wheel | 1:0.31.1-2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python3-pip | 9.0.3-16.el8 |
| Oracle Linux 8 | python3-pip-wheel | 9.0.3-16.el8 |
| Red Hat | python-urllib3 | pas de correctif indiqué |
| Red Hat | python2-urllib3 | pas de correctif indiqué |
| Red Hat | python27-python-pip | pas de correctif indiqué |
| Red Hat | python27-python-virtualenv | pas de correctif indiqué |
| Red Hat | rh-python36-python-pip | pas de correctif indiqué |
| Red Hat | rh-python36-python-virtualenv | pas de correctif indiqué |
| rocky 8 | python27:2.7::babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-Cython | 0.28.1-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-attrs | 17.4.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-chardet | 3.0.4-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-coverage | 4.5.1-4.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-dns | 1.15.0-10.module+el8.7.0+1062+663ba31c |
| rocky 8 | python27:2.7::python2-docs | 2.7.16-2.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-docs-info | 2.7.16-2.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-docutils | 0.14-12.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-idna | 2.5-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-jinja2 | 2.10-8.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-markupsafe | 0.23-19.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-mock | 2.0.0-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pluggy | 0.6.0-8.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-py | 1.5.3-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pysocks | 1.6.8-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest | 3.4.2-13.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pytz | 2017.2-12.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pyyaml | 3.12-16.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-requests | 2.20.0-3.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-rpm-macros | 3-38.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python36:3.6::python-nose-docs | 1.3.7-30.module+el8.3.0+120+426d8baf |
| root.io debian 12 | rootio-python-urllib3 | 1.24-1 |
| ubuntu 16.04 | python-urllib3 | 1.13.1-2ubuntu0.16.04.3 |
| ubuntu 16.04-ESM | python-urllib3 | 1.13.1-2ubuntu0.16.04.3 |
| ubuntu 18.04 | python-urllib3 | 1.22-1ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | python-urllib3 | 1.22-1ubuntu0.18.04.1 |
| ubuntu 18.10 | python-urllib3 | 1.22-1ubuntu0.18.10.1 |
Références
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- https://access.redhat.com/errata/RHSA-2019:2272
- https://access.redhat.com/errata/RHSA-2020:1605
- https://access.redhat.com/security/cve/CVE-2018-20060
- https://bugzilla.redhat.com/1643829
- https://bugzilla.redhat.com/1649153
- https://bugzilla.redhat.com/1659551
- https://bugzilla.redhat.com/1700824
Les 52 références
- https://bugzilla.redhat.com/1702473
- https://bugzilla.redhat.com/1740347
- https://bugzilla.redhat.com/1749839
- https://bugzilla.redhat.com/1762422
- https://bugzilla.redhat.com/1763229
- https://bugzilla.redhat.com/show_bug.cgi?id=1643829
- https://bugzilla.redhat.com/show_bug.cgi?id=1649153
- https://bugzilla.redhat.com/show_bug.cgi?id=1659551
- https://bugzilla.redhat.com/show_bug.cgi?id=1700824
- https://bugzilla.redhat.com/show_bug.cgi?id=1702473
- https://bugzilla.redhat.com/show_bug.cgi?id=1740347
- https://bugzilla.redhat.com/show_bug.cgi?id=1749839
- https://bugzilla.redhat.com/show_bug.cgi?id=1762422
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20060
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11236
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11324
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16935
- https://errata.almalinux.org/8/ALSA-2020-1605.html
- https://errata.rockylinux.org/RLSA-2020:1605
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml
- https://github.com/urllib3/urllib3
- https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
- https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532
- https://github.com/urllib3/urllib3/issues/1316
- https://github.com/urllib3/urllib3/pull/1346
- https://linux.oracle.com/cve/CVE-2018-20060.html
- https://linux.oracle.com/errata/ELSA-2020-2081.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/
- https://nvd.nist.gov/vuln/detail/CVE-2018-20060
- https://security.netapp.com/advisory/ntap-20241227-0010
- https://security.netapp.com/advisory/ntap-20241227-0010/
- https://ubuntu.com/security/notices/USN-3990-1
- https://usn.ubuntu.com/3990-1
- https://usn.ubuntu.com/3990-1/
- https://www.cve.org/CVERecord?id=CVE-2018-20060