[Snyk: Med] urllib3 (Due 12/4/23)

[tmpayton]

Introduced through
urllib3@1.26.7, requests@2.31.0 and others
Fixed in
urllib3@1.26.18, @2.0.7

Exploit maturity
No known exploit

Detailed paths and remediation

Introduced through: project@0.0.0 › urllib3@1.26.7
Fix: Upgrade urllib3 to version 1.26.18 or 2.0.7

Introduced through: project@0.0.0 › requests@2.31.0 › urllib3@1.26.7
Fix: Pin urllib3 to version 1.26.18 or 2.0.7
Introduced through: project@0.0.0 › cachecontrol@0.11.5 › requests@2.31.0 › urllib3@1.26.7
Fix: Pin urllib3 to version 1.26.18 or 2.0.7

…and 4 more
Security information
Factors contributing to the scoring:

Snyk: [CVSS 4.2](https://security.snyk.io/vuln/SNYK-PYTHON-URLLIB3-6002459) - Medium Severity
NVD: Not available. NVD has not yet published its analysis.

Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when it processes HTTP redirects with a 303 status code, due to not stripping the request body when changing the request method from POST to GET. An attacker can potentially expose sensitive information by compromising the origin service and redirecting requests to a malicious peer.