StackRadar

CVE-2024-37891

Medium

Advisory

Published 17 Jun 2024In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.011
65th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
608
of 17,787 indexed, latest versions
Container images
651
deployed by those charts
Fix available
4 of 4
affected packages

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

Carried by container images the latest versions of 608 of 17,787 indexed charts deploy, on 651 images.

Affected packageAffected versionsFixed inImages
python-urllib3deb1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+8 more1.13.1-2ubuntu0.16.04.4+esm2, 1.22-1ubuntu0.18.04.2+esm2, 1.25.8-2ubuntu0.4, 1.26.5-1~exp1ubuntu0.2+1 more46
urllib3pypi1.7.1, 1.10.2, 1.13.1, 1.19.1+42 more1.26.19, 2.2.2630
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+16 more8.1.1-2ubuntu0.6+esm10, 9.0.1-2.3~ubuntu1.18.04.8+esm6, 20.0.2-5ubuntu1.11, 22.0.2+dfsg-1ubuntu0.5+1 more70
python-urllib3rpm1.24.2-4.el8, 1.24.2-5.el8, 1.24.2-5.el8_6.1, 1.24.2-5.el8_9.2+3 more0:1.24.2-5.el8_6.3, 0:1.24.2-8.el8_10, 0:1.26.5-5.el9_4.134
OSV records
DEBIAN-CVE-2024-37891GHSA-34jh-p97f-mpxfRHSA-2024:5041RHSA-2024:5309RHSA-2024:6162UBUNTU-CVE-2024-37891
Also known as
PYSEC-2026-1995, RHSA-2024:5526, RHSA-2024:6240, USN-7084-1, USN-7084-2

Charts affected

608 by stars
ChartLatestAffected imagesRadar Score
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
python-urllib3@1.25.8-2ubuntu0.1
urllib3@1.25.8
1.25.8-2ubuntu0.4
1.26.19

Open the chart page →

18,923
uptime-kumahelmforgeVerified publisher1.5.121 of 1See more

uptime-kuma helmforge 1.5.12

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.33e24e96c89ef
urllib3@1.26.12
1.26.19

Open the chart page →

30,106
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
urllib3@2.2.1
2.2.2

Open the chart page →

11,441
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
python-pip@22.0.2+dfsg-1ubuntu0.4
urllib3@2.2.1
22.0.2+dfsg-1ubuntu0.5
2.2.2

Open the chart page →

14,350
httpbin2022httpbin2022Verified publisher0.1.11 of 1See more

httpbin2022 httpbin2022 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
mshanley80/httpbin2022:latest5b189a70c0fb
python-pip@20.0.2-5ubuntu1.6
20.0.2-5ubuntu1.11

Open the chart page →

8,732
activation-servicei4trustVerified publisher2.3.11 of 1See more

activation-service i4trust 2.3.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
i4trust/activation-service:2.2.09f3719176893
urllib3@2.0.3
2.2.2

Open the chart page →

2,057
iframelyiframelyVerified publisher2.3.51 of 1See more

iframely iframely 2.3.5

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
urllib3@1.26.5
1.26.19

Open the chart page →

3,181
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
arunvelsriram/utils:latest655ad18fd8d6
urllib3@2.0.7
2.2.2

Open the chart page →

9,032
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:1.2.0e4770285aaf7
python-pip@20.0.2-5ubuntu1.6
urllib3@1.26.5
20.0.2-5ubuntu1.11
1.26.19

Open the chart page →

37,844
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
urllib3@1.26.5
1.26.19

Open the chart page →

6,502
freeipaimprowisedVerified publisher0.4.11 of 1See more

freeipa improwised 0.4.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
freeipa/freeipa-server:fedora-37-4.10.1c87d77342bf5
urllib3@1.26.18
1.26.19

Open the chart page →

1,218
frigateimprowisedVerified publisher1.1.01 of 1See more

frigate improwised 1.1.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.13.07a5244e4c8dc
urllib3@2.1.0
2.2.2

Open the chart page →

2,159
healthchecksimprowisedVerified publisher1.1.11 of 2See more

healthchecks improwised 1.1.1

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
linuxserver/healthchecks:2.7.2023033194696dab3c50
urllib3@1.26.15
1.26.19

Open the chart page →

2,628
redashinseefrlab2.1.01 of 3See more

redash inseefrlab 2.1.0

1 of the 3 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
redash/redash:10.0.0.b503639392753c0376
urllib3@1.24.3
1.26.19

Open the chart page →

3,314
gmaintelVerified publisher0.1.01 of 1See more

gma intel 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
python-pip@20.0.2-5ubuntu1.6
20.0.2-5ubuntu1.11

Open the chart page →

7,697
itm-servicesintelVerified publisher2.0.01 of 8See more

itm-services intel 2.0.0

1 of the 8 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
python-pip@20.0.2-5ubuntu1.6
python-urllib3@1.25.8-2ubuntu0.1
urllib3@1.25.8
20.0.2-5ubuntu1.11
1.25.8-2ubuntu0.4
1.26.19

Open the chart page →

18,137
map5gintelVerified publisher1.0.01 of 1See more

map5g intel 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
python-pip@20.0.2-5ubuntu1.6
20.0.2-5ubuntu1.11

Open the chart page →

7,697
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
urllib3@1.26.6
1.26.19

Open the chart page →

7,233
istio-bookinfoistio-bookinfo1.2.21 of 6See more

istio-bookinfo istio-bookinfo 1.2.2

1 of the 6 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
urllib3@1.24.2
1.26.19

Open the chart page →

18,998
wjh-rechnerit-at-mOfficialVerified publisher1.0.41 of 1See more

wjh-rechner it-at-m 1.0.4

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/wjh-rechner:1.0.0bc70cdb5a01a
python-urllib3@1.26.5-3.el9_3.1
urllib3@1.26.5
0:1.26.5-5.el9_4.1
1.26.19

Open the chart page →

3,487
twitch-channel-points-minerjacobcolvinVerified publisher0.1.01 of 1See more

twitch-channel-points-miner jacobcolvin 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
urllib3@2.0.4
2.2.2

Open the chart page →

1,088
koptimizejaconiVerified publisher0.5.41 of 2See more

koptimize jaconi 0.5.4

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
alpine/k8s:1.27.321b24e6bf801
urllib3@1.26.16
1.26.19

Open the chart page →

5,716
deconzjanip81-helm-chartsVerified publisher0.1.11 of 1See more

deconz janip81-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.29.2062de2362641
urllib3@1.26.12
1.26.19

Open the chart page →

10,816
jx-app-anchorejenkins-x0.0.41 of 2See more

jx-app-anchore jenkins-x 0.0.4

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.7.1ed9b3badd17c
urllib3@1.25.8
1.26.19

Open the chart page →

9,853
shynetjuniorjpdj0.1.301 of 1See more

shynet juniorjpdj 0.1.30

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
urllib3@1.26.12
1.26.19

Open the chart page →

2,581
frigatek8s-home-lab-repo9.1.11 of 1See more

frigate k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
blakeblackshear/frigate:0.11.18330b0a265b8
urllib3@1.26.12
1.26.19

Open the chart page →

2,370
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
python-pip@22.0.2+dfsg-1ubuntu0.2
22.0.2+dfsg-1ubuntu0.5

Open the chart page →

9,832
librephotosk8sonlabVerified publisher1.1.61 of 7See more

librephotos k8sonlab 1.1.6

1 of the 7 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
alpine/k8s:1.22.600ac10bcb759
urllib3@1.26.9
1.26.19

Open the chart page →

14,833
netio-exporterk8sonlabVerified publisher0.1.101 of 1See more

netio-exporter k8sonlab 0.1.10

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
tomsajan/netio-exporter:0.0.5fb61907707b8
urllib3@2.2.1
2.2.2

Open the chart page →

728
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
python-pip@20.0.2-5ubuntu1.6
urllib3@1.26.14
20.0.2-5ubuntu1.11
1.26.19

Open the chart page →

16,464
mlflowkelvins0.4.01 of 3See more

mlflow kelvins 0.4.0

1 of the 3 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kelvinsp/mlflow:1.26.1cd33e6db2a59
urllib3@1.26.9
1.26.19

Open the chart page →

4,156
allurekfirfer0.1.81 of 2See more

allure kfirfer 0.1.8

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.21.08a4d7e9308de
python-pip@9.0.1-2.3~ubuntu1.18.04.6
urllib3@1.25.11
9.0.1-2.3~ubuntu1.18.04.8+esm6
1.26.19

Open the chart page →

12,541
elastalert2kfirfer2.2.51 of 1See more

elastalert2 kfirfer 2.2.5

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
jertel/elastalert2:2.2.34dcc0ef93efc
urllib3@1.26.7
1.26.19

Open the chart page →

1,598
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
urllib3@1.26.17
1.26.19

Open the chart page →

6,446
kibana-index-pattern-updaterkfirfer0.0.31 of 1See more

kibana-index-pattern-updater kfirfer 0.0.3

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kfirfer/kibana-index-pattern-updater:1.0.12e88cfcec5c93
urllib3@1.26.2
1.26.19

Open the chart page →

3,357
kube-hunterkfirfer1.0.51 of 1See more

kube-hunter kfirfer 1.0.5

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
aquasec/kube-hunter:0.6.8e64fe49f059f
urllib3@1.26.9
1.26.19

Open the chart page →

997
scriptskfirfer0.1.361 of 1See more

scripts kfirfer 0.1.36

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kfirfer/scripts:0.0.2481e5c4e5d70e
urllib3@1.26.7
1.26.19

Open the chart page →

2,320
slackgptkfirfer0.0.61 of 1See more

slackgpt kfirfer 0.0.6

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kfirfer/slackgpt:0.0.15461331bd838e
urllib3@2.0.7
2.2.2

Open the chart page →

1,125
kovi-appkovi-charts0.8.11 of 1See more

kovi-app kovi-charts 0.8.1

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kennethreitz/httpbin:latest599fe5e50731
python-pip@9.0.1-2.3~ubuntu1
9.0.1-2.3~ubuntu1.18.04.8+esm6

Open the chart page →

14,827
kubeflowkromanow94-kubeflow0.5.11 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

1 of the 30 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
urllib3@1.26.16
1.26.19

Open the chart page →

68,994
lnbitskronkltdVerified publisher0.1.01 of 1See more

lnbits kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:latest26fae6327477
urllib3@2.1.0
2.2.2

Open the chart page →

1,444
specter-desktopkronkltdVerified publisher0.1.01 of 1See more

specter-desktop kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
lncm/specter-desktop:v0.10.4bca14d04397d
urllib3@1.25.10
1.26.19

Open the chart page →

1,850
jupyterhubkubeblocksVerified publisher0.1.02 of 7See more

jupyterhub kubeblocks 0.1.0

2 of the 7 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
urllib3@2.0.4
2.2.2
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
urllib3@2.0.4
2.2.2

Open the chart page →

7,356
lokikubeblocksVerified publisher5.39.01 of 5See more

loki kubeblocks 5.39.0

1 of the 5 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.24.35af76eebbba7
urllib3@1.26.16
1.26.19

Open the chart page →

5,841
smartfs-csi-driverkubeblocksVerified publisher0.1.21 of 6See more

smartfs-csi-driver kubeblocks 0.1.2

1 of the 6 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
apecloud/smartfs-csi-driver:0.1.1ff2858eab9cc
python-urllib3@1.24.2-5.el8
urllib3@1.24.2
0:1.24.2-8.el8_10
1.26.19

Open the chart page →

9,249
cephfs-csikubegems1.0.81 of 6See more

cephfs-csi kubegems 1.0.8

1 of the 6 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.5.128a674af1df2
urllib3@1.24.2
1.26.19

Open the chart page →

4,445
juicefs-csi-driverkubegems0.19.21 of 6See more

juicefs-csi-driver kubegems 0.19.2

1 of the 6 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.23.0d915e899e322
urllib3@1.26.5
1.26.19

Open the chart page →

4,825
juicefs-tenantkubegems1.0.11 of 3See more

juicefs-tenant kubegems 1.0.1

1 of the 3 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
kubegems/juicefs-mount:ce-v1.1.010abb76892b8
urllib3@1.24.1
1.26.19

Open the chart page →

4,120
kube-janitorkube-janitor0.3.31 of 1See more

kube-janitor kube-janitor 0.3.3

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
hjacobs/kube-janitor:23.7.0fbb303ed463c
urllib3@2.0.3
2.2.2

Open the chart page →

3,700
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
urllib3@1.26.12
1.26.19

Open the chart page →

6,363

Container images carrying it

651 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
urllib3@1.26.5
1.26.19
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.