urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).
urllib3 anterior a 1.24.2 no elimina el encabezado HTTP de autorización cuando se sigue una redirección de origen cruzado (es decir, una redirección que difiere en host, puerto o esquema). Esto puede permitir que las credenciales en el encabezado de autorización se expongan a hosts no deseados o se transmitan en texto plano. NOTA: este problema existe debido a una solución incompleta para CVE-2018-20060 (que distinguía entre mayúsculas y minúsculas).
A flaw was found in the urllib3 package. Affected versions of this package are vulnerable to information exposure through sent data when the authorization HTTP header is not removed during a cross-origin redirect. An attacker can expose credentials in the authorization header to unintended hosts or transmit them in clear text by exploiting the incomplete fix for CVE-2018-20060.
