Information Exposure Through Sent Data Affecting urllib3 package, versions [,1.26.17) [2.0.0,2.0.6)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-URLLIB3-5926907
- published 3 Oct 2023
- disclosed 2 Oct 2023
- credit ranjit-git, Quentin Pradet, Illia Volochii, Seth Michael Larson
Introduced: 2 Oct 2023
CVE-2023-43804 Open this link in a new tabHow to fix?
Upgrade urllib3 to version 1.26.17, 2.0.6 or higher.
Overview
urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.
Affected versions of this package are vulnerable to Information Exposure Through Sent Data when the Cookie HTTP header is used. An attacker can leak information via HTTP redirects to a different origin by exploiting the fact that the Cookie HTTP header isn't stripped on cross-origin redirects.
Note:
This is only exploitable if the user is using the Cookie header on requests, not disabling HTTP redirects, and either not using HTTPS or for the origin server to redirect to a malicious origin.
##Workaround:
This vulnerability can be mitigated by disabling HTTP redirects using redirects=False when sending requests and by not using the Cookie header.