CVE-2023-43804GHSA-V845-JXX5-VC9FPYSEC-2023-192
`Cookie` HTTP header isn't stripped on cross-origin redirects
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.0.6, 1.26.17
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Timeline
- CVE published
- Record last updated
Affected versions
- urllib3 urllib3
From 2.0.0 · fixed in 2.0.6; fixed in 1.26.17
- urllib3PyPI
From 2.0.0 · fixed in 2.0.6
- urllib3PyPI
fixed in 1.26.17
- urllib3PyPI
From 2.0.0 · fixed in 2.0.6; fixed in 1.26.17