CVE-2024-37891

Medium

Advisory

Published 17 Jun 2024In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.011; 65th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 608; of 17,787 indexed, latest versions
Container images: 651; deployed by those charts
Fix available: 4 of 4; affected packages

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

Carried by container images the latest versions of 608 of 17,787 indexed charts deploy, on 651 images.

Affected package	Affected versions	Fixed in	Images
python-urllib3deb	1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+8 more	1.13.1-2ubuntu0.16.04.4+esm2, 1.22-1ubuntu0.18.04.2+esm2, 1.25.8-2ubuntu0.4, 1.26.5-1~exp1ubuntu0.2+1 more	46
urllib3pypi	1.7.1, 1.10.2, 1.13.1, 1.19.1+42 more	1.26.19, 2.2.2	630
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+16 more	8.1.1-2ubuntu0.6+esm10, 9.0.1-2.3~ubuntu1.18.04.8+esm6, 20.0.2-5ubuntu1.11, 22.0.2+dfsg-1ubuntu0.5+1 more	70
python-urllib3rpm	1.24.2-4.el8, 1.24.2-5.el8, 1.24.2-5.el8_6.1, 1.24.2-5.el8_9.2+3 more	0:1.24.2-5.el8_6.3, 0:1.24.2-8.el8_10, 0:1.26.5-5.el9_4.1	34

OSV records: DEBIAN-CVE-2024-37891 GHSA-34jh-p97f-mpxf RHSA-2024:5041 RHSA-2024:5309 RHSA-2024:6162 UBUNTU-CVE-2024-37891
Also known as: PYSEC-2026-1995, RHSA-2024:5526, RHSA-2024:6240, USN-7084-1, USN-7084-2

Charts affected

608 by stars

Chart

Latest

Affected images

Radar Score

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container image	Digest	Package	Fixed in
datawire/emissary :3.12.2	1f67a1292d2a	urllib3@2.2.1	2.2.2

Open the chart page →

10,857

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2024-37891.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	urllib3@1.26.12	1.26.19

Open the chart page →

8,824

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2024-37891.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	urllib3@1.24.2	1.26.19

Open the chart page →

10,286

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2024-37891.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	urllib3@1.24.2	1.26.19

Open the chart page →

11,785

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	urllib3@1.26.3	1.26.19

Open the chart page →

1,843

marge-botwiremind

1.4.4

1 of 1 See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container image	Digest	Package	Fixed in
hiboxsystems/marge-bot :0.14.0	dcffb926e563	urllib3@2.0.4	2.2.2

Open the chart page →

5,548

powerdnsadminwitcom-gmbh

0.3.4

1 of 1 See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	urllib3@1.25.11	1.26.19

Open the chart page →

2,643

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	urllib3@1.26.15	1.26.19

Open the chart page →

1,838

Container images carrying it

651 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
socialmediamacroscope/preprocessing :0.1.3	ca863306314b	urllib3@1.26.16	1.26.19	1
socialmediamacroscope/screen_name_prompt :0.1.2	724f3f5702e0	urllib3@1.26.15	1.26.19	1
socialmediamacroscope/topic_modeling :0.1.3	fa490acac2f8	urllib3@1.26.16	1.26.19	1
softonic/gar-exporter :0.2.1	a64d6c0e0ae5	urllib3@1.25.11	1.26.19	1
softonic/mysql-backup :0.4.0	d9487a8dd70f	urllib3@1.26.8	1.26.19	1
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	python-pip@20.0.2-5ubuntu1.6 python-urllib3@1.25.8-2ubuntu0.1 urllib3@1.25.8	20.0.2-5ubuntu1.11 1.25.8-2ubuntu0.4 1.26.19	1
sonatype/nexus :oss	6bc88b51d4d7	urllib3@1.10.2	1.26.19	1
splunk/splunk-operator :2.0.0	c4e0d3146226	python-urllib3@1.24.2-5.el8 urllib3@1.24.2	0:1.24.2-5.el8_6.3 1.26.19	1
sslhep/servicex-did-finder :v1.8.5	ab0090083567	urllib3@1.26.5	1.26.19	1
sslhep/x509-secrets :v1.8.5	d9e9ecb12d59	urllib3@1.26.5	1.26.19	1
stackstorm/st2actionrunner :3.8	88235ba70cad	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.26.18	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2api :3.8	6f56d239d280	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.25.8	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2auth :3.8	33ecfda16608	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.25.8	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.26.18	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2notifier :3.8	f190a6212195	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.25.8	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2rulesengine :3.8	259503496ff9	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.26.18	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2scheduler :3.8	b1de2055c362	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.25.8	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.25.8	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2stream :3.8	1c8904a3bf67	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.26.18	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.25.8	1.25.8-2ubuntu0.4 1.26.19	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.25.8	1.25.8-2ubuntu0.4 1.26.19	1
stakewiselabs/bls-horcrux :v1.0.0	2afd0c0b34cb	urllib3@1.26.2	1.26.19	1
stashapp/stash :latest	24dbd7607174	python-urllib3@1.25.8-2ubuntu0.1 urllib3@1.25.8	1.25.8-2ubuntu0.4 1.26.19	1
statcan/ckan :2.9	3921305425b8	python-pip@20.0.2-5ubuntu1.5 urllib3@1.25.8	20.0.2-5ubuntu1.11 1.26.19	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.16	11bceacec8fb	python-pip@20.0.2-5ubuntu1.5	20.0.2-5ubuntu1.11	1
streamnative/private-cloud-console :v2.3.27-all	91e54375e154	urllib3@1.26.18	1.26.19	1
substratusai/verba :v0.4.0-baseURL2	61695be635eb	urllib3@2.2.1	2.2.2	1
supabase/realtime :v2.102.3	aa1c92c0cf32	urllib3@1.26.12	1.26.19	1
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	urllib3@1.26.18	1.26.19	1
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	python-urllib3@1.25.8-2ubuntu0.3 urllib3@1.26.9	1.25.8-2ubuntu0.4 1.26.19	1
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	urllib3@1.26.18	1.26.19	1
swisscomcloud/esc-vm-scheduler-web :latest	b6639d1a922e	urllib3@1.26.13	1.26.19	1
t3nde/gtmetrix-bq :0.2.0	d2939e9a719b	urllib3@1.25.9	1.26.19	1
tachyongroup/mlflow-deployment-controller :mlflow-controller-0.1.8	7e79b9000856	urllib3@1.26.14	1.26.19	1
tachyongroup/mlflow-deployment-controller-ui :mlflow-controller-0.1.8	f4f7fabe1037	urllib3@1.26.7	1.26.19	1
taigaio/taiga-back :6.4.2	9f97323cc150	urllib3@1.24.3	1.26.19	1
teknas09/bird-pod :latest	12a1fa85c4aa	urllib3@2.2.1	2.2.2	1
tenableofficial/nessus :latest	c88e43fe1a8c	urllib3@1.26.18	1.26.19	1
th0th/node-red :4.0.3-debian	d06fa39f7406	urllib3@1.26.5	1.26.19	1
thongngo3301/stakefish :latest	a341af5976e3	urllib3@2.2.1	2.2.2	1
timescale/timescaledb-ha :pg15-latest	a8e3322e1cf9	python-urllib3@1.26.5-1~exp1 urllib3@1.26.5	1.26.5-1~exp1ubuntu0.2 1.26.19	1
timescale/timescaledb-ha :pg14.6-ts2.9.1-p1	cdb9ae118899	python-urllib3@1.26.5-1~exp1 urllib3@1.26.5	1.26.5-1~exp1ubuntu0.2 1.26.19	1
timescale/timescaledb-ha :pg16	d7db8f1085a3	urllib3@1.26.5	1.26.19	1
timescale/timescaledb-ha :pg17.2-ts2.18.2	e8d0a9cc3db5	urllib3@1.26.5	1.26.19	1
timescale/timescaledb-ha :pg14-ts2.6-latest	ed719c0cd19d	python-urllib3@1.26.5-1~exp1 urllib3@1.26.5	1.26.5-1~exp1ubuntu0.2 1.26.19	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	python-pip@8.1.1-2ubuntu0.4 urllib3@1.22	8.1.1-2ubuntu0.6+esm10 1.26.19	1
tomsajan/netio-exporter :0.0.5	fb61907707b8	urllib3@2.2.1	2.2.2	1
tomsquest/docker-radicale :3.1.1.0	4759cc353a1d	urllib3@1.26.5	1.26.19	1
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	urllib3@1.24.1	1.26.19	1
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python-urllib3@1.26.5-1~exp1ubuntu0.1 urllib3@1.26.5	1.26.5-1~exp1ubuntu0.2 1.26.19	1