Moderate: python-urllib3 security update
Summary
ALSA-2024:0116: Moderate: python-urllib3 security update. Affects python3-urllib3 versions < 1.24.2-5.el8_9.2. Fixed in 1.24.2-5.el8_9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-urllib3 package is a Python HTTP module that provides connection pooling and file POST abilities. It is commonly used in Python applications for making HTTP requests. This package is vulnerable to two security issues.
Vulnerability Detail
The first vulnerability (CVE-2023-43804) is related to cross-origin redirects. When making a request, the Cookie request header is not properly stripped during cross-origin redirects, which could lead to potential security risks. The second vulnerability (CVE-2023-45803) occurs when a redirect from a 303 status changes the request method to GET. In this case, the request body is not stripped, which could result in unexpected behavior or information disclosure.
How To Fix
Minimum fixed version
1.24.2-5.el8_9.2
This is the first release that contains the fix.
sudo dnf update python3-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
The python-urllib3 package has been found to have two security vulnerabilities. It is recommended to update to the latest version to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python3-urllib3 →
FAQ
Python-urllib3 is a Python HTTP module that provides connection pooling and file POST abilities.
Cross-origin redirect occurs when a request is redirected from one origin to another. It can be a security risk if certain headers or information are not properly handled during the redirect.
CVE-2023-43804 is a vulnerability in python-urllib3 where the Cookie request header isn't stripped during cross-origin redirects.
CVE-2023-45803 is a vulnerability in python-urllib3 where the request body is not stripped after a redirect from a 303 status changes the request method to GET.
To fix these vulnerabilities, update the python-urllib3 package to version 1.24.2-5.el8_9.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for python3-urllib3.
