Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2023-43804

`Cookie` HTTP header isn't stripped on cross-origin redirects

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

urllib3 urllib3

  • >= 2.0.0, < 2.0.6affected
  • < 1.26.17affected

References