{"id":"CVE-2024-37891","title":"urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)","summary":"A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the `Proxy-Authorization` HTTP header as one carrying authentication material. This issue results in not stripping the header…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-669","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","affected":["ansible_automation_platform 1.2","ansible_automation_platform 2","enterprise_linux 7","enterprise_linux 8","openshift_container_platform 3.11","openshift_container_platform 4","openshift_data_science_rhods","quay 3","software_collections","storage 3","ansible_automation_platform_2_4_for_rhel 8","openstack_platform 17.1","satellite_6_16_for_rhel 8","ansible_automation_platform_2_4_for_rhel 9","developer_hub_1_3_for_rhel 9","satellite_6_16_for_rhel 9","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_e4s_v_8_4","enterprise_linux_appstream_tus_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_eus_v_8_8","enterprise_linux_appstream_e4s_v_9_0","enterprise_linux_appstream_eus_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_e4s_v_8_6","enterprise_linux_baseos_tus_v_8_6","enterprise_linux_baseos_eus_v_8_8","enterprise_linux_baseos_e4s_v_9_0","enterprise_linux_baseos_eus_v_9_2","enterprise_linux_baseos_v_9","enterprise_linux_highavailability_v_8","enterprise_linux_high_availability_aus_v_8_4","enterprise_linux_highavailability_e4s_v_8_4","enterprise_linux_highavailability_tus_v_8_4"],"patched":["ansible_automation_platform_2_4_for_rhel 8","openstack_platform 17.1","satellite_6_16_for_rhel 8","ansible_automation_platform_2_4_for_rhel 9","developer_hub_1_3_for_rhel 9","satellite_6_16_for_rhel 9","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_e4s_v_8_4","enterprise_linux_appstream_tus_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_eus_v_8_8","enterprise_linux_appstream_e4s_v_9_0","enterprise_linux_appstream_eus_v_9_2","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_e4s_v_8_6","enterprise_linux_baseos_tus_v_8_6","enterprise_linux_baseos_eus_v_8_8","enterprise_linux_baseos_e4s_v_9_0","enterprise_linux_baseos_eus_v_9_2","enterprise_linux_baseos_v_9","enterprise_linux_highavailability_v_8","enterprise_linux_high_availability_aus_v_8_4","enterprise_linux_highavailability_e4s_v_8_4","enterprise_linux_highavailability_tus_v_8_4","enterprise_linux_high_availability_e4s_v_8_6","enterprise_linux_high_availability_tus_v_8_6","enterprise_linux_high_availability_eus_v_8_8","enterprise_linux_high_availability_e4s_v_9_0","enterprise_linux_high_availability_eus_v_9_2","enterprise_linux_highavailability_v_9","enterprise_linux_resilientstorage_v_8","enterprise_linux_resilient_storage_eus_v_8_8","enterprise_linux_resilientstorage_e4s_v_9_0","enterprise_linux_resilient_storage_eus_v_9_2"],"published":"2024-06-17","updated":"2026-10-13","sourceUpdated":"2026-10-13T23:36:14+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-37891.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-37891.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-37891"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292788"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37891"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37891"},{"url":"https://access.redhat.com/errata/RHSA-2024:6765"},{"url":"https://access.redhat.com/errata/RHSA-2024:7312"},{"url":"https://access.redhat.com/errata/RHSA-2024:9985"},{"url":"https://access.redhat.com/errata/RHSA-2024:8906"},{"url":"https://access.redhat.com/errata/RHBA-2024:7523"},{"url":"https://access.redhat.com/errata/RHSA-2024:5258"},{"url":"https://access.redhat.com/errata/RHSA-2024:6309"},{"url":"https://access.redhat.com/errata/RHSA-2024:8843"},{"url":"https://access.redhat.com/errata/RHSA-2024:8842"},{"url":"https://access.redhat.com/errata/RHSA-2024:4730"},{"url":"https://access.redhat.com/errata/RHSA-2024:5622"},{"url":"https://access.redhat.com/errata/RHSA-2024:4746"},{"url":"https://access.redhat.com/errata/RHSA-2024:8035"},{"url":"https://access.redhat.com/errata/RHSA-2024:5627"},{"url":"https://access.redhat.com/errata/RHSA-2024:5633"},{"url":"https://access.redhat.com/errata/RHSA-2024:9922"},{"url":"https://access.redhat.com/errata/RHSA-2024:9923"},{"url":"https://access.redhat.com/errata/RHSA-2024:4422"},{"url":"https://access.redhat.com/errata/RHSA-2024:9458"},{"url":"https://access.redhat.com/errata/RHSA-2024:9457"},{"url":"https://access.redhat.com/errata/RHSA-2024:5309"},{"url":"https://access.redhat.com/errata/RHSA-2024:5041"},{"url":"https://access.redhat.com/errata/RHSA-2024:5526"},{"url":"https://access.redhat.com/errata/RHSA-2024:6358"},{"url":"https://access.redhat.com/errata/RHSA-2024:6240"},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf"},{"url":"https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468"},{"url":"https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e"},{"url":"https://github.com/urllib3/urllib3"},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"url":"https://security.netapp.com/advisory/ntap-20240822-0003"},{"url":"https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.01141,"epssPercentile":0.66485,"aliases":["GHSA-34jh-p97f-mpxf","PYSEC-2026-1995"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:44.668Z","slug":"CVE-2024-37891","body":"## Overview\n\nA flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the `Proxy-Authorization` HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects.\n\n## Vendor advisories\n\n- **RHSA-2024:6765** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 · released 2024-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2024:6765)\n- **RHSA-2024:7312** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 · released 2024-09-27 · [advisory](https://access.redhat.com/errata/RHSA-2024:7312)\n- **RHSA-2024:9985** · Red Hat · fixed in: Red Hat OpenStack Platform 17.1 · released 2024-11-21 · [advisory](https://access.redhat.com/errata/RHSA-2024:9985)\n- **RHSA-2024:8906** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2024-11-05 · [advisory](https://access.redhat.com/errata/RHSA-2024:8906)\n- **RHBA-2024:7523** · Red Hat · fixed in: Red Hat Developer Hub 1.3 for RHEL 9 · released 2024-10-02 · [advisory](https://access.redhat.com/errata/RHBA-2024:7523)\n- **RHSA-2024:5258** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2024:5258)\n- **RHSA-2024:6309** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2024-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2024:6309)\n- **RHSA-2024:8843** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-11-05 · [advisory](https://access.redhat.com/errata/RHSA-2024:8843)\n- **RHSA-2024:8842** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-11-05 · [advisory](https://access.redhat.com/errata/RHSA-2024:8842)\n- **RHSA-2024:4730** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4), Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability E4S (v.8.4), Red Hat Enterprise Linux HighAvailability TUS (v.8.4) · released 2024-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2024:4730)\n- **RHSA-2024:5622** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6), Red Hat Enterprise Linux High Availability E4S (v.8.6), Red Hat Enterprise Linux High Availability TUS (v.8.6) · released 2024-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2024:5622)\n- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat Ansible Automation Platform 1.2, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 3.11, Red Hat Storage 3, … · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-37891.json)\n\n**urllib3: proxy-authorization request header is not stripped during cross-origin redirects** — rated Moderate by Red Hat. Released 2024-06-17, updated 2026-10-13.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 1.2\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Data Science (RHODS)\n- Red Hat Quay 3\n- Red Hat Software Collections\n- Red Hat Storage 3\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.4 for RHEL 8\n- Red Hat OpenStack Platform 17.1\n- Red Hat Satellite 6.16 for RHEL 8\n- Red Hat Ansible Automation Platform 2.4 for RHEL 9\n- Red Hat Developer Hub 1.3 for RHEL 9\n- Red Hat Satellite 6.16 for RHEL 9\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream AUS (v.8.4)\n- Red Hat Enterprise Linux AppStream E4S (v.8.4)\n- Red Hat Enterprise Linux AppStream TUS (v.8.4)\n- Red Hat Enterprise Linux AppStream AUS (v.8.6)\n- Red Hat Enterprise Linux AppStream E4S (v.8.6)\n- Red Hat Enterprise Linux AppStream TUS (v.8.6)\n- Red Hat Enterprise Linux AppStream EUS (v.8.8)\n- Red Hat Enterprise Linux AppStream E4S (v.9.0)\n- Red Hat Enterprise Linux AppStream EUS (v.9.2)\n- Red Hat Enterprise Linux AppStream EUS (v.9.4)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Enterprise Linux BaseOS (v. 8)\n- Red Hat Enterprise Linux BaseOS AUS (v.8.6)\n- Red Hat Enterprise Linux BaseOS E4S (v.8.6)\n- Red Hat Enterprise Linux BaseOS TUS (v.8.6)\n- Red Hat Enterprise Linux BaseOS EUS (v.8.8)\n- Red Hat Enterprise Linux BaseOS E4S (v.9.0)\n- Red Hat Enterprise Linux BaseOS EUS (v.9.2)\n- Red Hat Enterprise Linux BaseOS (v. 9)\n- Red Hat Enterprise Linux HighAvailability (v. 8)\n- Red Hat Enterprise Linux High Availability AUS (v.8.4)\n- Red Hat Enterprise Linux HighAvailability E4S (v.8.4)\n- Red Hat Enterprise Linux HighAvailability TUS (v.8.4)\n- Red Hat Enterprise Linux High Availability E4S (v.8.6)\n- Red Hat Enterprise Linux High Availability TUS (v.8.6)\n- Red Hat Enterprise Linux High Availability EUS (v.8.8)\n- Red Hat Enterprise Linux High Availability E4S (v.9.0)\n- Red Hat Enterprise Linux High Availability EUS (v.9.2)\n- Red Hat Enterprise Linux HighAvailability (v. 9)\n- Red Hat Enterprise Linux ResilientStorage (v. 8)\n- Red Hat Enterprise Linux Resilient Storage EUS (v.8.8)\n- Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)\n- Red Hat Enterprise Linux Resilient Storage EUS (v.9.2)\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 1.2\n- Red Hat Enterprise Linux 7\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat Storage 3\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Data Science (RHODS)\n- Red Hat Software Collections\n- Red Hat Ansible Automation Platform 2\n- Red Hat Quay 3\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.4 for RHEL 8\n- Red Hat Satellite 6.16 for RHEL 8\n- Red Hat Ansible Automation Platform 2.4 for RHEL 9\n- Red Hat Developer Hub 1.3 for RHEL 9\n- Red Hat Satellite 6.16 for RHEL 9\n- Red Hat Ansible Automation Platform 2\n- Red Hat Discovery 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nRed Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2024:6765\nRed Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2024:7312\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:9985\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2024-37891)\n\nAffected packages:\n\n- `urllib3 < 1.26.19`\n- `urllib3 >= 2.0.0, < 2.2.2`\n\nPatched in:\n\n- `urllib3 1.26.19`\n- `urllib3 2.2.2`\n\nSource: https://osv.dev/vulnerability/GHSA-34jh-p97f-mpxf","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}