StackRadar

CVE-2024-37891

Medium

Advisory

Published 17 Jun 2024In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.011
65th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
603
of 17,787 indexed, latest versions
Container images
646
deployed by those charts
Fix available
4 of 4
affected packages

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

Carried by container images the latest versions of 603 of 17,787 indexed charts deploy, on 646 images.

Affected packageAffected versionsFixed inImages
python-urllib3deb1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+8 more1.13.1-2ubuntu0.16.04.4+esm2, 1.22-1ubuntu0.18.04.2+esm2, 1.25.8-2ubuntu0.4, 1.26.5-1~exp1ubuntu0.2+1 more46
urllib3pypi1.7.1, 1.10.2, 1.13.1, 1.19.1+42 more1.26.19, 2.2.2626
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+15 more8.1.1-2ubuntu0.6+esm10, 9.0.1-2.3~ubuntu1.18.04.8+esm6, 20.0.2-5ubuntu1.11, 22.0.2+dfsg-1ubuntu0.569
python-urllib3rpm1.24.2-4.el8, 1.24.2-5.el8, 1.24.2-5.el8_6.1, 1.24.2-5.el8_9.2+3 more0:1.24.2-5.el8_6.3, 0:1.24.2-8.el8_10, 0:1.26.5-5.el9_4.134
OSV records
DEBIAN-CVE-2024-37891GHSA-34jh-p97f-mpxfRHSA-2024:5041RHSA-2024:5309RHSA-2024:6162UBUNTU-CVE-2024-37891
Also known as
PYSEC-2026-1995, RHSA-2024:5526, RHSA-2024:6240, USN-7084-1, USN-7084-2

Charts affected

603 by stars
ChartLatestAffected imagesRadar Score
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
urllib3@2.0.4
2.2.2

Open the chart page →

5,542
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
urllib3@1.25.11
1.26.19

Open the chart page →

2,643
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2024-37891.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
urllib3@1.26.15
1.26.19

Open the chart page →

1,838

Container images carrying it

646 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
crazymax/rtorrent-rutorrent:3.10-0.9.8-0.13.8fb307f5b87bf
urllib3@1.26.13
1.26.19
1
danuk/telegram-sender:0.0.1026560388070
urllib3@1.26.12
1.26.19
1
daskdev/dask:1.1.04ecd7bc35500
urllib3@1.23
1.26.19
1
daskdev/dask-notebook:1.1.0052630f5ca04
urllib3@1.24.1
1.26.19
1
datadog/agent:7.22.08f20e56b5311
urllib3@1.25.10
1.26.19
1
datamate/seafile-professional:11.0.202dd66b722464
urllib3@1.26.18
1.26.19
1
datawire/aes:2.0.3-ea07f8fe4f4f8e
urllib3@1.26.3
1.26.19
1
datawire/aes:1.13.62beb65062c8b
urllib3@1.26.3
1.26.19
1
datawire/aes:3.11.195ec30b3c732
urllib3@2.2.1
2.2.2
1
datawire/emissary:3.12.21f67a1292d2a
urllib3@2.2.1
2.2.2
1
datawire/emissary:2.0.2-ea9716efbdd24b
urllib3@1.26.3
1.26.19
1
dchesterton/amcrest2mqtt:1.0.9cc70f2238aa9
urllib3@1.26.6
1.26.19
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
urllib3@2.2.1
2.2.2
1
ddosify/selfhosted_backend:3.2.93c11e3182652
urllib3@2.2.1
2.2.2
1
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
urllib3@2.2.1
2.2.2
1
ddosify/selfhosted_hammermanager:1.2.471b8768f49bc
urllib3@2.2.1
2.2.2
1
deconzcommunity/deconz:2.29.2062de2362641
urllib3@1.26.12
1.26.19
1
deconzcommunity/deconz:2.12.066541bbb78952
urllib3@1.24.1
1.26.19
1
deepflowce/deepflow-app:v6.2.6.5a1888d35e787
urllib3@1.25.11
1.26.19
1
devopstales/kube-openid-connector:1.042c40a0e9f1b
urllib3@1.26.9
1.26.19
1
devopstales/trivy-operator:2.575136aa7a26e
urllib3@1.26.14
1.26.19
1
djjudas21/autonodelabel:0.0.6f17233350c4f
urllib3@1.26.16
1.26.19
1
dockerid31415926/pod-pvc-mapping:v0.1.3354309669f16
urllib3@1.26.7
1.26.19
1
dockerid31415926/pvc-exporter:v0.1.35a1dd17e0e07
urllib3@1.26.7
1.26.19
1
douz/helpdesk:latest4384103d0219
urllib3@1.25.11
1.26.19
1
dpage/pgadmin4:8.418cd5711fc9a
urllib3@1.26.18
1.26.19
1
dpage/pgadmin4:7.537946e4f3e7b
urllib3@1.26.16
1.26.19
1
dysnix/pritunl:v1.29-r819951e3e7a32
urllib3@1.25.8
1.26.19
1
eclipseaerios/hlo-allocator:v3.0.03cc1d94cfe96
urllib3@2.2.0
2.2.2
1
eclipseaerios/hlo-data-aggregator:v3.0.0b433c2b9f5dc
urllib3@2.2.0
2.2.2
1
eclipseaerios/hlo-deployment-engine:v3.0.0d582d39208c7
urllib3@2.1.0
2.2.2
1
eclipseaerios/hlo-fe-engine:v3.0.08ed2df4ca692
urllib3@2.2.0
2.2.2
1
elastichq/elasticsearch-hq:latestbb3bd22c2b87
urllib3@1.22
1.26.19
1
elautoestopista/raponchi:0.3.0b6f74db9fc81
urllib3@1.26.18
1.26.19
1
elyra/kernel-image-puller:3.2.2c922f1f1646a
urllib3@1.26.15
1.26.19
1
erlangsolutions/wombatoam:4.1.284680c990147a
urllib3@1.26.5
1.26.19
1
errbotio/errbot:6.1.900ee4e0953ab
urllib3@1.26.9
1.26.19
1
esailors/aws-ecr-http-proxy:1.5.15608ae045fa7
urllib3@1.26.7
1.26.19
1
esphome/esphome:1.18.03f51ec10e823
urllib3@1.26.4
1.26.19
1
esphome/esphome:2024.3.09ab8cc88b28c
urllib3@2.2.1
2.2.2
1
evgkrsk/postgres-controller:0.6.237f0e1f435c3
urllib3@1.26.14
1.26.19
1
evk02/mlflow:2.2.1ef6ff257ef35
urllib3@1.26.15
1.26.19
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
urllib3@1.26.13
1.26.19
1
fiware/bae-activation-service:v0.0.33e3ec88d59ed
urllib3@1.26.2
1.26.19
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
urllib3@1.25.8
1.26.19
1
fiware/orion-ld:1.10.03c490a746f65
urllib3@1.24.2
1.26.19
1
flag5/clustersecret:0.0.94ad5748bfcc6
urllib3@1.26.7
1.26.19
1
flagsmith/flagsmith-api:v2.6.0fd58556339a4
urllib3@1.25.11
1.26.19
1
flyway/flyway:9.1545b5d7cdc75a
python-pip@20.0.2-5ubuntu1.8
20.0.2-5ubuntu1.11
1
fossology/fossology:4.2.18bd1f22ba7bb
urllib3@1.26.12
1.26.19
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.