CVE-2024-37891 – Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

https://notcve.org/view.php?id=CVE-2024-37891

17 Jun 2024 — urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authoriz... • https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e • CWE-669: Incorrect Resource Transfer Between Spheres •