Homepage
About Snyk

urllib3@1.26.4 vulnerabilities

HTTP library with thread-safe connection pooling, file post, and more.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the urllib3 package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Information Exposure Through Sent Data

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when it processes HTTP redirects with a 303 status code, due to not stripping the request body when changing the request method from POST to GET. An attacker can potentially expose sensitive information by compromising the origin service and redirecting requests to a malicious peer.

Note:

This is only exploitable if sensitive information is being submitted in the HTTP request body and the origin service is compromised, starting to redirect using 303 to a malicious peer or the redirected-to service becomes compromised.

How to fix Information Exposure Through Sent Data?

Upgrade urllib3 to version 1.26.18, 2.0.7 or higher.

[,1.26.18) [2.0.0,2.0.7)
  • M
Information Exposure Through Sent Data

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when the Cookie HTTP header is used. An attacker can leak information via HTTP redirects to a different origin by exploiting the fact that the Cookie HTTP header isn't stripped on cross-origin redirects.

Note:

This is only exploitable if the user is using the Cookie header on requests, not disabling HTTP redirects, and either not using HTTPS or for the origin server to redirect to a malicious origin.

##Workaround:

This vulnerability can be mitigated by disabling HTTP redirects using redirects=False when sending requests and by not using the Cookie header.

How to fix Information Exposure Through Sent Data?

Upgrade urllib3 to version 1.26.17, 2.0.6 or higher.

[,1.26.17) [2.0.0,2.0.6)
  • M
Regular Expression Denial of Service (ReDoS)

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the SUBAUTHORITY_PAT regex pattern in src/urllib3/util/url.py.

If a URL is passed as a parameter or redirected to via an HTTP redirect and it contains many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade urllib3 to version 1.26.5 or higher.

[,1.26.5)
Go back to all versions of this package