critical
CVE-2018-20060
python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat5.3CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Photon OS. Rated lower by Red Hat (medium), AlmaLinux (medium), Amazon (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (low).
Description
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 1.0 | python-urllib3 | 1.26.6-1.ph1 |
| Photon OS 2.0 | python-urllib3 | 1.26.6-1.ph2 |
| pip::GitHub Security Advisory pip | urllib3 | 1.23 |
| alma 8 | python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython, python27:2.7::python2-PyMySQL and 25 more | 2.7.5-7.module_el8.6.0+2781+fed64c13 and 23 more |
| amazon linux 1 | python26-urllib3, python27-urllib3 | 1.24.1-1.6.amzn1 |
| amazon linux 2 | python-urllib3, python-virtualenv | 1.24.3-1.amzn2.0.1 and 1 more |
| debian 11 | python-urllib3 | 1.24-1 |
| debian 12 | python-urllib3 | 1.24-1 |
| debian 13 | python-urllib3 | 1.24-1 |
| debian 14 | python-urllib3 | 1.24-1 |
| debian 8 | python-urllib3 | no fix listed |
| debian 9 | python-urllib3 | 1.19.1-1+deb9u1 |
Show all 154 entries from 23 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 1.0 | python-urllib3 | 1.26.6-1.ph1 |
| Photon OS 2.0 | python-urllib3 | 1.26.6-1.ph2 |
| pip::GitHub Security Advisory pip | urllib3 | 1.23 |
| alma 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-Cython | 0.28.1-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-attrs | 17.4.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-chardet | 3.0.4-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-coverage | 4.5.1-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-dns | 1.15.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docs | 2.7.16-2.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docs-info | 2.7.16-2.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docutils | 0.14-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-idna | 2.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-markupsafe | 0.23-19.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-mock | 2.0.0-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pluggy | 0.6.0-8.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-py | 1.5.3-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pysocks | 1.6.8-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest | 3.4.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytz | 2017.2-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pyyaml | 3.12-16.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-requests | 2.20.0-3.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-rpm-macros | 3-38.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module_el8.6.0+2781+fed64c13 |
| amazon linux 1 | python26-urllib3 | 1.24.1-1.6.amzn1 |
| amazon linux 1 | python27-urllib3 | 1.24.1-1.6.amzn1 |
| amazon linux 2 | python-urllib3 | 1.24.3-1.amzn2.0.1 |
| amazon linux 2 | python-virtualenv | 15.1.0-4.amzn2 |
| debian 11 | python-urllib3 | 1.24-1 |
| debian 12 | python-urllib3 | 1.24-1 |
| debian 13 | python-urllib3 | 1.24-1 |
| debian 14 | python-urllib3 | 1.24-1 |
| debian 8 | python-urllib3 | no fix listed |
| debian 9 | python-urllib3 | 1.19.1-1+deb9u1 |
| echo | python-urllib3 | 1.24-1 |
| Oracle Linux 7 | python-urllib3 | 1.10.2-7.el7 |
| Oracle Linux 7 | python-virtualenv | 15.1.0-4.el7_8 |
| Oracle Linux 7 | python3-pip | 9.0.3-7.el7_8 |
| Oracle Linux 8 | babel | 2.5.1-9.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | platform-python-pip | 9.0.3-16.el8 |
| Oracle Linux 8 | python-nose-docs | 1.3.7-30.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python-psycopg2-doc | 2.7.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python-sqlalchemy-doc | 1.3.2-1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2 | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-Cython | 0.28.1-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-PyMySQL | 0.8.0-10.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-attrs | 17.4.0-10.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-babel | 2.5.1-9.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-backports | 1.0-15.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-backports-ssl_match_hostname | 3.5.0.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-bson | 3.6.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-chardet | 3.0.4-10.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-coverage | 4.5.1-4.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-debug | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-devel | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-dns | 1.15.0-10.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-docs | 2.7.16-2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-docs-info | 2.7.16-2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-docutils | 0.14-12.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-funcsigs | 1.0.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-idna | 2.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-ipaddress | 1.0.18-6.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-jinja2 | 2.10-8.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-libs | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-lxml | 4.2.3-3.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-markupsafe | 0.23-19.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-mock | 2.0.0-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-nose | 1.3.7-30.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-numpy | 1:1.14.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-numpy-doc | 1:1.14.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-numpy-f2py | 1:1.14.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pip | 9.0.3-16.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pip-wheel | 9.0.3-16.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pluggy | 0.6.0-8.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-psycopg2 | 2.7.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-psycopg2-debug | 2.7.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-psycopg2-tests | 2.7.5-7.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-py | 1.5.3-6.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pygments | 2.2.0-20.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pymongo | 3.6.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pymongo-gridfs | 3.6.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pysocks | 1.6.8-6.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pytest | 3.4.2-13.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pytest-mock | 1.9.0-4.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pytz | 2017.2-12.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-pyyaml | 3.12-16.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-requests | 2.20.0-3.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-rpm-macros | 3-38.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-scipy | 1.0.0-20.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-setuptools | 39.0.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-setuptools-wheel | 39.0.1-11.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-setuptools_scm | 1.15.7-6.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-six | 1.11.0-5.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-sqlalchemy | 1.3.2-1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-test | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-tkinter | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-tools | 2.7.17-1.0.1.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-urllib3 | 1.24.2-1.0.2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-virtualenv | 15.1.0-19.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-wheel | 1:0.31.1-2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python2-wheel-wheel | 1:0.31.1-2.module+el8.2.0+5577+bb63ba72 |
| Oracle Linux 8 | python3-pip | 9.0.3-16.el8 |
| Oracle Linux 8 | python3-pip-wheel | 9.0.3-16.el8 |
| Red Hat | python-urllib3 | no fix listed |
| Red Hat | python2-urllib3 | no fix listed |
| Red Hat | python27-python-pip | no fix listed |
| Red Hat | python27-python-virtualenv | no fix listed |
| Red Hat | rh-python36-python-pip | no fix listed |
| Red Hat | rh-python36-python-virtualenv | no fix listed |
| rocky 8 | python27:2.7::babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-Cython | 0.28.1-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-attrs | 17.4.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-chardet | 3.0.4-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-coverage | 4.5.1-4.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-dns | 1.15.0-10.module+el8.7.0+1062+663ba31c |
| rocky 8 | python27:2.7::python2-docs | 2.7.16-2.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-docs-info | 2.7.16-2.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-docutils | 0.14-12.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-idna | 2.5-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-jinja2 | 2.10-8.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-markupsafe | 0.23-19.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-mock | 2.0.0-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pluggy | 0.6.0-8.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-py | 1.5.3-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pysocks | 1.6.8-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest | 3.4.2-13.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pytz | 2017.2-12.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pyyaml | 3.12-16.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-requests | 2.20.0-3.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-rpm-macros | 3-38.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python36:3.6::python-nose-docs | 1.3.7-30.module+el8.3.0+120+426d8baf |
| root.io debian 12 | rootio-python-urllib3 | 1.24-1 |
| ubuntu 16.04 | python-urllib3 | 1.13.1-2ubuntu0.16.04.3 |
| ubuntu 16.04-ESM | python-urllib3 | 1.13.1-2ubuntu0.16.04.3 |
| ubuntu 18.04 | python-urllib3 | 1.22-1ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | python-urllib3 | 1.22-1ubuntu0.18.04.1 |
| ubuntu 18.10 | python-urllib3 | 1.22-1ubuntu0.18.10.1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- https://access.redhat.com/errata/RHSA-2019:2272
- https://access.redhat.com/errata/RHSA-2020:1605
- https://access.redhat.com/security/cve/CVE-2018-20060
- https://bugzilla.redhat.com/1643829
- https://bugzilla.redhat.com/1649153
- https://bugzilla.redhat.com/1659551
- https://bugzilla.redhat.com/1700824
All 52 references
- https://bugzilla.redhat.com/1702473
- https://bugzilla.redhat.com/1740347
- https://bugzilla.redhat.com/1749839
- https://bugzilla.redhat.com/1762422
- https://bugzilla.redhat.com/1763229
- https://bugzilla.redhat.com/show_bug.cgi?id=1643829
- https://bugzilla.redhat.com/show_bug.cgi?id=1649153
- https://bugzilla.redhat.com/show_bug.cgi?id=1659551
- https://bugzilla.redhat.com/show_bug.cgi?id=1700824
- https://bugzilla.redhat.com/show_bug.cgi?id=1702473
- https://bugzilla.redhat.com/show_bug.cgi?id=1740347
- https://bugzilla.redhat.com/show_bug.cgi?id=1749839
- https://bugzilla.redhat.com/show_bug.cgi?id=1762422
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20060
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11236
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11324
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16935
- https://errata.almalinux.org/8/ALSA-2020-1605.html
- https://errata.rockylinux.org/RLSA-2020:1605
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml
- https://github.com/urllib3/urllib3
- https://github.com/urllib3/urllib3/blob/master/CHANGES.rst
- https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532
- https://github.com/urllib3/urllib3/issues/1316
- https://github.com/urllib3/urllib3/pull/1346
- https://linux.oracle.com/cve/CVE-2018-20060.html
- https://linux.oracle.com/errata/ELSA-2020-2081.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/
- https://nvd.nist.gov/vuln/detail/CVE-2018-20060
- https://security.netapp.com/advisory/ntap-20241227-0010
- https://security.netapp.com/advisory/ntap-20241227-0010/
- https://ubuntu.com/security/notices/USN-3990-1
- https://usn.ubuntu.com/3990-1
- https://usn.ubuntu.com/3990-1/
- https://www.cve.org/CVERecord?id=CVE-2018-20060