StackRadar

CVE-2024-37891

Medium

Advisory

Published 17 Jun 2024In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.011
65th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
608
of 17,790 indexed, latest versions
Container images
650
deployed by those charts
Fix available
4 of 4
affected packages

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

Carried by container images the latest versions of 608 of 17,790 indexed charts deploy, on 650 images.

Affected packageAffected versionsFixed inImages
python-urllib3deb1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+8 more1.13.1-2ubuntu0.16.04.4+esm2, 1.22-1ubuntu0.18.04.2+esm2, 1.25.8-2ubuntu0.4, 1.26.5-1~exp1ubuntu0.2+1 more46
urllib3pypi1.7.1, 1.10.2, 1.13.1, 1.19.1+42 more1.26.19, 2.2.2629
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+16 more8.1.1-2ubuntu0.6+esm10, 9.0.1-2.3~ubuntu1.18.04.8+esm6, 20.0.2-5ubuntu1.11, 22.0.2+dfsg-1ubuntu0.5+1 more70
python-urllib3rpm1.24.2-4.el8, 1.24.2-5.el8, 1.24.2-5.el8_6.1, 1.24.2-5.el8_9.2+3 more0:1.24.2-5.el8_6.3, 0:1.24.2-8.el8_10, 0:1.26.5-5.el9_4.134
OSV records
DEBIAN-CVE-2024-37891GHSA-34jh-p97f-mpxfRHSA-2024:5041RHSA-2024:5309RHSA-2024:6162UBUNTU-CVE-2024-37891
Also known as
PYSEC-2026-1995, RHSA-2024:5526, RHSA-2024:6240, USN-7084-1, USN-7084-2

Charts affected

608 by stars
ChartLatestAffected imagesRadar Score
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
urllib3@1.26.12
1.26.19

Open the chart page →

30,217
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
urllib3@1.26.18
1.26.19

Open the chart page →

11,394
rook-cephrookOfficialVerified publisher1.20.71 of 2See more

rook-ceph rook 1.20.7

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
rook/ceph:v1.20.72f970c425617
urllib3@1.26.5
1.26.19

Open the chart page →

1,454
ceph-csi-cephfsceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-cephfs ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
urllib3@1.26.5
1.26.19

Open the chart page →

4,103
ceph-csi-rbdceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-rbd ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
urllib3@1.26.5
1.26.19

Open the chart page →

4,103
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
urllib3@1.26.11
1.26.19

Open the chart page →

9,197
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.8.2d538416d5afe
urllib3@1.26.7
1.26.19

Open the chart page →

32,420
stackgres-operatorstackgres-chartsOfficialVerified publisher1.19.11 of 2See more

stackgres-operator stackgres-charts 1.19.1

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
quay.io/stackgres/operator:1.19.1f241b0b20326
urllib3@2.0.7
2.2.2

Open the chart page →

2,139
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
urllib3@1.26.3
1.26.19

Open the chart page →

4,093
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kinseii/wazuh-agent:4.14.17160eb143728
urllib3@2.2.0
2.2.2

Open the chart page →

11,431
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
urllib3@1.26.3
1.26.19

Open the chart page →

4,925
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
urllib3@2.0.3
2.2.2

Open the chart page →

4,310
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
urllib3@1.26.9
1.26.19

Open the chart page →

7,707
daskdask2024.1.12 of 2See more

dask dask 2024.1.1

2 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
ghcr.io/dask/dask:2024.1.0080150de7d86
urllib3@2.0.4
2.2.2
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
urllib3@2.1.0
2.2.2

Open the chart page →

12,838
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
urllib3@1.26.18
1.26.19

Open the chart page →

6,040
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
urllib3@1.26.3
1.26.19

Open the chart page →

5,180
milvusmilvus-helm5.0.281 of 4See more

milvus milvus-helm 5.0.28

1 of the 4 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.0.79c9947de139d
python-pip@22.0.2+dfsg-1ubuntu0.4
22.0.2+dfsg-1ubuntu0.5

Open the chart page →

10,782
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
urllib3@1.25.3
1.26.19

Open the chart page →

5,852
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.26.18
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2api:3.86f56d239d280
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.25.8
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2auth:3.833ecfda16608
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.25.8
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.26.18
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2notifier:3.8f190a6212195
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.25.8
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2rulesengine:3.8259503496ff9
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.26.18
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2scheduler:3.8b1de2055c362
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.25.8
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2sensorcontainer:3.8b1a338f64773
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.25.8
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2stream:3.81c8904a3bf67
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.26.18
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2timersengine:3.81bf35bfaf00c
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.25.8
1.25.8-2ubuntu0.4
1.26.19
stackstorm/st2workflowengine:3.819fdfffdbba8
python-urllib3@1.25.8-2ubuntu0.3
urllib3@1.25.8
1.25.8-2ubuntu0.4
1.26.19

Open the chart page →

96,933
kube-prometheuschoerodon9.3.11 of 7See more

kube-prometheus choerodon 9.3.1

1 of the 7 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:0.1.1517b98eecdf6d1
urllib3@1.25.9
1.26.19

Open the chart page →

12,251
dependabot-gitlabdependabot-gitlabVerified publisher6.3.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
urllib3@2.0.7
2.2.2

Open the chart page →

4,641
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
urllib3@1.25.9
1.26.19

Open the chart page →

30,504
barmanadfinisVerified publisher0.10.01 of 1See more

barman adfinis 0.10.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
ubcctlt/barman:v2.19cbbbbc8ae16b
urllib3@1.25.11
1.26.19

Open the chart page →

1,552
wazuh-agentavistoVerified publisher4.12.21 of 1See more

wazuh-agent avisto 4.12.2

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
ghcr.io/avistotelecom/docker-wazuh-agent:4.12.08766ba08bf1a
urllib3@1.26.12
1.26.19

Open the chart page →

6,531
awx-operatorawx-operator-helm3.2.11 of 2See more

awx-operator awx-operator-helm 3.2.1

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
python-urllib3@1.24.2-5.el8_9.2
urllib3@1.26.18
0:1.24.2-8.el8_10
1.26.19

Open the chart page →

9,882
uptime-kumaduyet0.1.71 of 1See more

uptime-kuma duyet 0.1.7

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.18.5a84767d7934f
urllib3@1.24.1
1.26.19

Open the chart page →

4,522
servarrservarr1.0.22 of 10See more

servarr servarr 1.0.2

2 of the 10 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
nyurik/alpine-python3-requests:lateste0553236e3eb
urllib3@1.26.6
1.26.19
ghcr.io/flaresolverr/flaresolverr:v3.3.16088412db1051
urllib3@2.2.1
2.2.2

Open the chart page →

14,231
openvpn-asas-helm-chartOfficialVerified publisher0.2.11 of 1See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
openvpn/openvpn-as:latest2253c10ec652
urllib3@2.0.7
2.2.2

Open the chart page →

2,722
fadicetic0.3.13 of 25See more

fadi cetic 0.3.1

3 of the 25 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
urllib3@1.25.3
1.26.19
jupyterhub/k8s-hub:0.11.1b6b4a1a34bf0
python-pip@20.0.2-5ubuntu1.1
urllib3@1.26.2
20.0.2-5ubuntu1.11
1.26.19
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
urllib3@1.25.11
1.26.19

Open the chart page →

53,052
daskhubdask2024.1.13 of 9See more

daskhub dask 2024.1.1

3 of the 9 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
urllib3@2.1.0
2.2.2
ghcr.io/dask/dask-gateway-server:2024.1.0881e7acfc5a0
urllib3@2.1.0
2.2.2
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
urllib3@2.1.0
2.2.2

Open the chart page →

14,151
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
urllib3@1.26.18
1.26.19

Open the chart page →

27,426
netbird-dashboardjaconiVerified publisher1.2.11 of 1See more

netbird-dashboard jaconi 1.2.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
netbirdio/dashboard:v2.90.2332cc31f5f35
urllib3@1.26.5
1.26.19

Open the chart page →

585
kubeflowkubeflow1.6.25 of 45See more

kubeflow kubeflow 1.6.2

5 of the 45 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kserve/models-web-app:v0.8.063ea05e73842
urllib3@1.26.9
1.26.19
kubeflownotebookswg/jupyter-web-app:v1.6.1d762690e21c1
urllib3@1.26.12
1.26.19
kubeflownotebookswg/tensorboards-web-app:v1.6.10876fef1973b
urllib3@1.26.12
1.26.19
kubeflownotebookswg/volumes-web-app:v1.6.17299fa94db15
urllib3@1.26.12
1.26.19
gcr.io/ml-pipeline/metadata-writer:2.0.0-alpha.5ec3ae9f6df47
urllib3@1.26.8
1.26.19

Open the chart page →

97,217
clustersecretpatrungel0.2.01 of 1See more

clustersecret patrungel 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
flag5/clustersecret:0.0.94ad5748bfcc6
urllib3@1.26.7
1.26.19

Open the chart page →

1,841
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
taigaio/taiga-back:6.4.29f97323cc150
urllib3@1.24.3
1.26.19

Open the chart page →

7,256
openspeedtestspeedtestVerified publisher0.1.21 of 1See more

openspeedtest speedtest 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
openspeedtest/latest:v2.0.0d4d62f4b7d85
urllib3@1.26.12
1.26.19

Open the chart page →

2,040
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
urllib3@2.2.1
2.2.2

Open the chart page →

1,650
k8s-telegram-sendertelegram-senderVerified publisher0.0.11 of 1See more

k8s-telegram-sender telegram-sender 0.0.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
danuk/telegram-sender:0.0.1026560388070
urllib3@1.26.12
1.26.19

Open the chart page →

3,048
grafana-pdf-exporterwiremindVerified publisher2.1.11 of 1See more

grafana-pdf-exporter wiremind 2.1.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
python-urllib3@1.26.12-1
urllib3@1.26.12
1.26.12-1+deb12u1
1.26.19

Open the chart page →

9,775
aws-ecr-credentialarchitectminds1.4.21 of 1See more

aws-ecr-credential architectminds 1.4.2

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
architectminds/aws-kubectl:1.19735e59a1085
urllib3@1.25.3
1.26.19

Open the chart page →

1,437
backup-zenbzen0.1.41 of 1See more

backup-zen bzen 0.1.4

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
rezachalak/bzen-mongo:1.0.034f694325191
python-pip@20.0.2-5ubuntu1.9
urllib3@2.0.4
20.0.2-5ubuntu1.11
2.2.2

Open the chart page →

8,026
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.24.35af76eebbba7
urllib3@1.26.16
1.26.19

Open the chart page →

24,753
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
urllib3@1.26.18
1.26.19

Open the chart page →

17,569
ecr-proxyevryfs-ossVerified publisher0.2.91 of 1See more

ecr-proxy evryfs-oss 0.2.9

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
esailors/aws-ecr-http-proxy:1.5.15608ae045fa7
urllib3@1.26.7
1.26.19

Open the chart page →

1,523
openshift-secured-appeximiaitVerified publisher0.5.01 of 1See more

openshift-secured-app eximiait 0.5.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
quay.io/openshift/origin-oauth-proxy:4.14a7dff785d821
python-urllib3@1.24.2-5.el8
urllib3@1.24.2
0:1.24.2-5.el8_6.3
1.26.19

Open the chart page →

12,049
openshift-secured-pgadmineximiaitVerified publisher0.2.02 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

2 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
urllib3@1.26.16
1.26.19
quay.io/openshift/origin-oauth-proxy:4.14a7dff785d821
python-urllib3@1.24.2-5.el8
urllib3@1.24.2
0:1.24.2-5.el8_6.3
1.26.19

Open the chart page →

14,552
openshift-secured-redisInsighteximiaitVerified publisher0.9.22 of 2See more

openshift-secured-redisInsight eximiait 0.9.2

2 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
redislabs/redisinsight:1.14.0b03ab1426d0d
urllib3@1.26.9
1.26.19
quay.io/openshift/origin-oauth-proxy:4.14a7dff785d821
python-urllib3@1.24.2-5.el8
urllib3@1.24.2
0:1.24.2-5.el8_6.3
1.26.19

Open the chart page →

13,881
deconzgeek-cookbookVerified publisher6.5.21 of 1See more

deconz geek-cookbook 6.5.2

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.12.066541bbb78952
urllib3@1.24.1
1.26.19

Open the chart page →

3,556
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
urllib3@1.26.4
1.26.19

Open the chart page →

3,718
frigategeek-cookbookVerified publisher8.2.21 of 1See more

frigate geek-cookbook 8.2.2

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
blakeblackshear/frigate:0.10.0-amd64ae269270ad9e
python-pip@20.0.2-5ubuntu1.6
20.0.2-5ubuntu1.11

Open the chart page →

10,647

Container images carrying it

650 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

No deployed image carries CVE-2024-37891.

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.