CVE-2024-37891Medium· 4.4▾ Sunlit

urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the `Proxy-Authorization` HTTP header as one carrying authentication material. This issue results in not stripping the header…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score24/ 100 · Low

impact 24.2 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 17, 2024

Updated

Oct 13, 2026

CVSS

4.4

Vendor

Red Hat

Product

Red Hat Enterprise Linux AppStream (v. 8)

CWE

CWE-669

Depth score

24 · Low

EPSS

1.1% · p66

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Aug 2.

1.1% → 1.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 848 days

Jun 17, 2024Published
Disclosed via CSAF
Aug 2, 2026EPSS first tracked
1.1%
Oct 13, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-669 #csaf #vex #red-hat #osv #pip

Affected

Patched in

ansible_automation_platform_2_4_for_rhel 8
openstack_platform 17.1
satellite_6_16_for_rhel 8
ansible_automation_platform_2_4_for_rhel 9
developer_hub_1_3_for_rhel 9
satellite_6_16_for_rhel 9
enterprise_linux_appstream_v_8
enterprise_linux_appstream_aus_v_8_4
enterprise_linux_appstream_e4s_v_8_4
enterprise_linux_appstream_tus_v_8_4
enterprise_linux_appstream_aus_v_8_6
enterprise_linux_appstream_e4s_v_8_6
enterprise_linux_appstream_tus_v_8_6
enterprise_linux_appstream_eus_v_8_8
enterprise_linux_appstream_e4s_v_9_0
enterprise_linux_appstream_eus_v_9_2
enterprise_linux_appstream_eus_v_9_4
enterprise_linux_appstream_v_9
enterprise_linux_baseos_v_8
enterprise_linux_baseos_aus_v_8_6
enterprise_linux_baseos_e4s_v_8_6
enterprise_linux_baseos_tus_v_8_6
enterprise_linux_baseos_eus_v_8_8
enterprise_linux_baseos_e4s_v_9_0
enterprise_linux_baseos_eus_v_9_2
enterprise_linux_baseos_v_9
enterprise_linux_highavailability_v_8
enterprise_linux_high_availability_aus_v_8_4
enterprise_linux_highavailability_e4s_v_8_4
enterprise_linux_highavailability_tus_v_8_4
enterprise_linux_high_availability_e4s_v_8_6
enterprise_linux_high_availability_tus_v_8_6
enterprise_linux_high_availability_eus_v_8_8
enterprise_linux_high_availability_e4s_v_9_0
enterprise_linux_high_availability_eus_v_9_2
enterprise_linux_highavailability_v_9
enterprise_linux_resilientstorage_v_8
enterprise_linux_resilient_storage_eus_v_8_8
enterprise_linux_resilientstorage_e4s_v_9_0
enterprise_linux_resilient_storage_eus_v_9_2

Full technical detail▾

Overview

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects.

Vendor advisories

RHSA-2024:6765 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 · released 2024-09-18 · advisory
RHSA-2024:7312 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 · released 2024-09-27 · advisory
RHSA-2024:9985 · Red Hat · fixed in: Red Hat OpenStack Platform 17.1 · released 2024-11-21 · advisory
RHSA-2024:8906 · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2024-11-05 · advisory
RHBA-2024:7523 · Red Hat · fixed in: Red Hat Developer Hub 1.3 for RHEL 9 · released 2024-10-02 · advisory
RHSA-2024:5258 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-08-13 · advisory
RHSA-2024:6309 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2024-09-04 · advisory
RHSA-2024:8843 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-11-05 · advisory
RHSA-2024:8842 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-11-05 · advisory
RHSA-2024:4730 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4), Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability E4S (v.8.4), Red Hat Enterprise Linux HighAvailability TUS (v.8.4) · released 2024-07-23 · advisory
RHSA-2024:5622 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6), Red Hat Enterprise Linux High Availability E4S (v.8.6), Red Hat Enterprise Linux High Availability TUS (v.8.6) · released 2024-08-20 · advisory
Red Hat VEX · Moderate · affected: Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat Ansible Automation Platform 1.2, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 3.11, Red Hat Storage 3, … · updated 2026-10-13 · vex

urllib3: proxy-authorization request header is not stripped during cross-origin redirects — rated Moderate by Red Hat. Released 2024-06-17, updated 2026-10-13.

Affected:

Red Hat Ansible Automation Platform 1.2
Red Hat Ansible Automation Platform 2
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat OpenShift Container Platform 3.11
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Data Science (RHODS)
Red Hat Quay 3
Red Hat Software Collections
Red Hat Storage 3

Fixed:

Red Hat Ansible Automation Platform 2.4 for RHEL 8
Red Hat OpenStack Platform 17.1
Red Hat Satellite 6.16 for RHEL 8
Red Hat Ansible Automation Platform 2.4 for RHEL 9
Red Hat Developer Hub 1.3 for RHEL 9
Red Hat Satellite 6.16 for RHEL 9
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream AUS (v.8.4)
Red Hat Enterprise Linux AppStream E4S (v.8.4)
Red Hat Enterprise Linux AppStream TUS (v.8.4)
Red Hat Enterprise Linux AppStream AUS (v.8.6)
Red Hat Enterprise Linux AppStream E4S (v.8.6)
Red Hat Enterprise Linux AppStream TUS (v.8.6)
Red Hat Enterprise Linux AppStream EUS (v.8.8)
Red Hat Enterprise Linux AppStream E4S (v.9.0)
Red Hat Enterprise Linux AppStream EUS (v.9.2)
Red Hat Enterprise Linux AppStream EUS (v.9.4)
Red Hat Enterprise Linux AppStream (v. 9)
Red Hat Enterprise Linux BaseOS (v. 8)
Red Hat Enterprise Linux BaseOS AUS (v.8.6)
Red Hat Enterprise Linux BaseOS E4S (v.8.6)
Red Hat Enterprise Linux BaseOS TUS (v.8.6)
Red Hat Enterprise Linux BaseOS EUS (v.8.8)
Red Hat Enterprise Linux BaseOS E4S (v.9.0)
Red Hat Enterprise Linux BaseOS EUS (v.9.2)
Red Hat Enterprise Linux BaseOS (v. 9)
Red Hat Enterprise Linux HighAvailability (v. 8)
Red Hat Enterprise Linux High Availability AUS (v.8.4)
Red Hat Enterprise Linux HighAvailability E4S (v.8.4)
Red Hat Enterprise Linux HighAvailability TUS (v.8.4)
Red Hat Enterprise Linux High Availability E4S (v.8.6)
Red Hat Enterprise Linux High Availability TUS (v.8.6)
Red Hat Enterprise Linux High Availability EUS (v.8.8)
Red Hat Enterprise Linux High Availability E4S (v.9.0)
Red Hat Enterprise Linux High Availability EUS (v.9.2)
Red Hat Enterprise Linux HighAvailability (v. 9)
Red Hat Enterprise Linux ResilientStorage (v. 8)
Red Hat Enterprise Linux Resilient Storage EUS (v.8.8)
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2)

No fix planned:

Red Hat Ansible Automation Platform 1.2
Red Hat Enterprise Linux 7
Red Hat OpenShift Container Platform 3.11
Red Hat Storage 3
Red Hat Enterprise Linux 8
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Data Science (RHODS)
Red Hat Software Collections
Red Hat Ansible Automation Platform 2
Red Hat Quay 3

Not affected:

Red Hat Ansible Automation Platform 2.4 for RHEL 8
Red Hat Satellite 6.16 for RHEL 8
Red Hat Ansible Automation Platform 2.4 for RHEL 9
Red Hat Developer Hub 1.3 for RHEL 9
Red Hat Satellite 6.16 for RHEL 9
Red Hat Ansible Automation Platform 2
Red Hat Discovery 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Remediation

Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2024:6765 Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2024:7312 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:9985

Workarounds / mitigations:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Package advisory (CVE-2024-37891)

Affected packages:

urllib3 < 1.26.19
urllib3 >= 2.0.0, < 2.2.2

Patched in:

urllib3 1.26.19
urllib3 2.2.2

Source: https://osv.dev/vulnerability/GHSA-34jh-p97f-mpxf

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#pip

← Back to feed