Threats tagged 'brew-icloudpd-cve-2024-37891'

CVE-2024-37891 is a vulnerability in urllib3's handling of the Proxy-Authorization HTTP header during cross-origin redirects. When the Proxy-Authorization header is set manually without using urllib3's proxy support, it is not stripped on redirects, potentially exposing sensitive authentication information. This scenario requires specific conditions, including manual header setting without proxy support, enabled HTTP redirects, and redirects to a malicious origin. The vulnerability affects icloudpd versions from 1.17.3 up to but not including 1.25.1. A fix is available in version 1.25.1.