CVE-2024-37891
MediumAdvisory
Published 17 Jun 2024In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.011
- 65th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 600
- of 17,787 indexed, latest versions
- Container images
- 643
- deployed by those charts
- Fix available
- 4 of 4
- affected packages
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
Carried by container images the latest versions of 600 of 17,787 indexed charts deploy, on 643 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python-urllib3deb | 1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+8 more | 1.13.1-2ubuntu0.16.04.4+esm2, 1.22-1ubuntu0.18.04.2+esm2, 1.25.8-2ubuntu0.4, 1.26.5-1~exp1ubuntu0.2+1 more | 46 |
| urllib3pypi | 1.7.1, 1.10.2, 1.13.1, 1.19.1+42 more | 1.26.19, 2.2.2 | 623 |
| python-pipdeb | 1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+15 more | 8.1.1-2ubuntu0.6+esm10, 9.0.1-2.3~ubuntu1.18.04.8+esm6, 20.0.2-5ubuntu1.11, 22.0.2+dfsg-1ubuntu0.5 | 69 |
| python-urllib3rpm | 1.24.2-4.el8, 1.24.2-5.el8, 1.24.2-5.el8_6.1, 1.24.2-5.el8_9.2+3 more | 0:1.24.2-5.el8_6.3, 0:1.24.2-8.el8_10, 0:1.26.5-5.el9_4.1 | 34 |
- OSV records
- DEBIAN-CVE-2024-37891GHSA-34jh-p97f-mpxfRHSA-2024:5041RHSA-2024:5309RHSA-2024:6162UBUNTU-CVE-2024-37891
- Also known as
- PYSEC-2026-1995, RHSA-2024:5526, RHSA-2024:6240, USN-7084-1, USN-7084-2
Charts affected
600 by stars
| Chart | Latest | Affected images | Radar Score |
|---|
Container images carrying it
643 by charts deploying them
A fixed version is listed for 4 of the 4 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| assistiot/ | e32b87786142 | urllib3 | 1.26.19 | 1 |
| assistiot/ | e5ae539ce2cb | python-pip python-urllib3 urllib3 | 20.0.2-5ubuntu1.11 1.25.8-2ubuntu0.4 1.26.19 | 1 |
| balihb/ | ee48e79f5d76 | urllib3 | 1.26.19 | 1 |
| baserow/ | e0b3c8130b91 | urllib3 | 1.26.19 | 1 |
| baserow/ | df0c42eb67e8 | urllib3 | 1.26.19 | 1 |
| bbvalabs/ | 3ea299ae63c0 | urllib3 | 1.26.19 | 1 |
| benbusby/ | f77f7e6e4ad2 | urllib3 | 1.26.19 | 1 |
| bicarus/ | b1dab0721e1c | python-pip | 20.0.2-5ubuntu1.11 | 1 |
| billimek/ | 801bba1228ac | urllib3 | 1.26.19 | 1 |
| billimek/ | f14ccd7aad0e | urllib3 | 1.26.19 | 1 |
| billimek/ | bf8158556035 | urllib3 | 1.26.19 | 1 |
| blacktop/ | fc5e68e2f5ab | urllib3 | 1.26.19 | 1 |
| blakeblackshear/ | ae269270ad9e | python-pip | 20.0.2-5ubuntu1.11 | 1 |
| bootc/ | f1383295e7be | urllib3 | 1.26.19 | 1 |
| browserless/ | c81ae5585b47 | python-urllib3 urllib3 | 1.25.8-2ubuntu0.4 1.26.19 | 1 |
| buildkite/ | aec38cfaae0e | urllib3 | 1.26.19 | 1 |
| buntha/ | 154542cc3083 | urllib3 | 1.26.19 | 1 |
| camerahub/ | a5af37dd6e1b | urllib3 | 1.26.19 | 1 |
| camptocamp/ | acfafc308d88 | urllib3 | 1.26.19 | 1 |
| camptocamp/ | 35c91d5fda04 | urllib3 | 1.26.19 | 1 |
| camptocamp/ | bff736b15623 | urllib3 | 1.26.19 | 1 |
| camptocamp/ | 2924b43dbf40 | urllib3 | 1.26.19 | 1 |
| cdignam/ | 5a6a55b39cee | urllib3 | 1.26.19 | 1 |
| ceph/ | 90f30824a96e | urllib3 | 1.26.19 | 1 |
| chetangautamm/ | e7f7049e1544 | python-urllib3 urllib3 | 1.25.8-2ubuntu0.4 1.26.19 | 1 |
| chubaofs/ | 15ff74209ce7 | urllib3 | 1.26.19 | 1 |
| chubaofs/ | 205030e045f2 | urllib3 | 1.26.19 | 1 |
| citizenstig/ | b81c818ccb86 | python-pip | 8.1.1-2ubuntu0.6+esm10 | 1 |
| ckan/ | 84d11924549f | urllib3 | 1.26.19 | 1 |
| cleveritcz/ | c75c1636e0b7 | urllib3 | 1.26.19 | 1 |
| cloudve/ | af56e77ca587 | python-pip urllib3 | 9.0.1-2.3~ubuntu1.18.04.8+esm6 1.26.19 | 1 |
| cloudve/ | d79c1c5881c0 | urllib3 | 1.26.19 | 1 |
| codaprotocol/ | 37c68e67a401 | urllib3 | 1.26.19 | 1 |
| codaprotocol/ | 4ba4dd3a041f | urllib3 | 1.26.19 | 1 |
| codecov/ | 0475cb1c3136 | urllib3 | 1.26.19 | 1 |
| codecov/ | 837f546b479b | urllib3 | 1.26.19 | 1 |
| confluentinc/ | f2975d507a2a | urllib3 | 1.26.19 | 1 |
| confluentinc/ | 8f1544df1f48 | urllib3 | 1.26.19 | 1 |
| confluentinc/ | 3bf359d5e340 | urllib3 | 1.26.19 | 1 |
| confluentinc/ | c0224a1adf7a | urllib3 | 2.2.2 | 1 |
| confluentinc/ | dc9b972db002 | urllib3 | 2.2.2 | 1 |
| confluentinc/ | 4bc70a83ca6f | urllib3 | 1.26.19 | 1 |
| confluentinc/ | b0b7aa26254a | urllib3 | 1.26.19 | 1 |
| confluentinc/ | 8ec46c27982f | urllib3 | 2.2.2 | 1 |
| confluentinc/ | ee403d5b9090 | urllib3 | 1.26.19 | 1 |
| confluentinc/ | b651d4b6185a | urllib3 | 1.26.19 | 1 |
| confluentinc/ | 0bec03c1f3ce | urllib3 | 2.2.2 | 1 |
| confluentinc/ | 78c190f4472c | urllib3 | 1.26.19 | 1 |
| countly/ | e3c238248f99 | python-urllib3 urllib3 | 1.25.8-2ubuntu0.4 1.26.19 | 1 |
| craigwillis/ | ae317d7e4724 | urllib3 | 1.26.19 | 1 |