Headline
CVE-2023-43804: Merge pull request from GHSA-v845-jxx5-vc9f · urllib3/urllib3@644124e
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn’t treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn’t disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Expand Up @@ -141,20 +141,21 @@ def test_redirect_cross_host_remove_headers(self) -> None: "GET", f"{self.base_url}/redirect", fields={"target": f"{self.base_url_alt}/headers"}, headers={"Authorization": "foo"}, headers={"Authorization": "foo", "Cookie": "foo=bar"}, )
assert r.status == 200
data = r.json()
assert “Authorization” not in data assert “Cookie” not in data
r = http.request( "GET", f"{self.base_url}/redirect", fields={"target": f"{self.base_url_alt}/headers"}, headers={"authorization": "foo"}, headers={"authorization": "foo", "cookie": "foo=bar"}, )
assert r.status == 200 Expand All @@ -163,14 +164,16 @@ def test_redirect_cross_host_remove_headers(self) -> None:
assert “authorization” not in data assert “Authorization” not in data assert “cookie” not in data assert “Cookie” not in data
def test_redirect_cross_host_no_remove_headers(self) -> None: with PoolManager() as http: r = http.request( "GET", f"{self.base_url}/redirect", fields={"target": f"{self.base_url_alt}/headers"}, headers={"Authorization": "foo"}, headers={"Authorization": "foo", "Cookie": "foo=bar"}, retries=Retry(remove_headers_on_redirect=[]), )
Expand All @@ -179,14 +182,19 @@ def test_redirect_cross_host_no_remove_headers(self) -> None: data = r.json()
assert data[“Authorization”] == “foo” assert data[“Cookie”] == “foo=bar”
def test_redirect_cross_host_set_removed_headers(self) -> None: with PoolManager() as http: r = http.request( "GET", f"{self.base_url}/redirect", fields={"target": f"{self.base_url_alt}/headers"}, headers={"X-API-Secret": "foo", "Authorization": "bar"}, headers={ "X-API-Secret": "foo", "Authorization": "bar", "Cookie": "foo=bar", }, retries=Retry(remove_headers_on_redirect=[“X-API-Secret”]), )
Expand All @@ -196,8 +204,13 @@ def test_redirect_cross_host_set_removed_headers(self) -> None:
assert “X-API-Secret” not in data assert data[“Authorization”] == “bar” assert data[“Cookie”] == “foo=bar”
headers = {"x-api-secret": "foo", "authorization": "bar"} headers = { "x-api-secret": "foo", "authorization": "bar", "cookie": "foo=bar", } r = http.request( "GET", f"{self.base_url}/redirect", Expand All @@ -213,9 +226,14 @@ def test_redirect_cross_host_set_removed_headers(self) -> None: assert “x-api-secret” not in data assert “X-API-Secret” not in data assert data[“Authorization”] == “bar” assert data[“Cookie”] == “foo=bar”
# Ensure the header argument itself is not modified in-place. assert headers == {"x-api-secret": "foo", "authorization": "bar"} assert headers == { "x-api-secret": "foo", "authorization": "bar", "cookie": "foo=bar", }
def test_redirect_without_preload_releases_connection(self) -> None: with PoolManager(block=True, maxsize=2) as http: Expand Down
Related news
Red Hat Security Advisory 2024-0733-03 - An update is now available for Red Hat Ansible Automation Platform 2.4. Issues addressed include an information leakage vulnerability.
Red Hat Security Advisory 2024-0300-03 - An update for python-urllib3 is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Security Advisory 2024-0187-03 - An update for python-urllib3 is now available for Red Hat OpenStack Platform 17.1.
Red Hat Security Advisory 2023-7528-01 - An update for fence-agents is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.
Red Hat Security Advisory 2023-7523-01 - An update for fence-agents is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions.
Red Hat Security Advisory 2023-7435-01 - An update for fence-agents is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.
Ubuntu Security Notice 6473-2 - USN-6473-1 fixed vulnerabilities in urllib3. This update provides the corresponding updates for the urllib3 module bundled into pip. It was discovered that urllib3 didn't strip HTTP Authorization header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Ubuntu Security Notice 6473-1 - It was discovered that urllib3 didn't strip HTTP Authorization header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that urllib3 didn't strip HTTP Cookie header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information.
Red Hat Security Advisory 2023-6158-01 - An update is now available for Red Hat Ansible Automation Platform 2.4.
urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. Users **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach. ## Affected usages We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: * Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6) * Using the `Cookie` header on requests, which is mostly typical for impersonating a browser. * Not disabling HTTP redirects * Either not using HTTPS or for the origin serve...