Product:

Urllib3

(Python)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 12
Date Id Summary Products Score Patch Annotated
2023-10-17 CVE-2023-45803 urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in... Fedora, Urllib3 4.2
2018-12-11 CVE-2018-20060 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. Fedora, Urllib3 9.8