Sensitive Information Disclosure

urllib3 is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of the Proxy-Authorization header, which is not removed on cross-origin redirects, which could allow an attacker to expose sensntive authentication material to unintended hosts. Note that this vulnerability is only exploitable when sending requests without urllib3’s proxy support.