Moderate: python3.11-urllib3 security update
Summary
ALSA-2024:2159: Moderate: python3.11-urllib3 security update. Affects python3.11-urllib3 versions < 1.26.12-2.el9. Fixed in 1.26.12-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-urllib3 package is a Python HTTP module that provides connection pooling and file POST abilities. It is commonly used for making HTTP requests in Python applications.
Vulnerability Detail
The vulnerability in python3.11-urllib3 is related to the handling of cookie request headers during cross-origin redirects. This issue allows an attacker to bypass security restrictions and potentially steal sensitive information or perform unauthorized actions. The impact of this vulnerability can vary depending on the specific usage of the package in different applications.
How To Fix
Minimum fixed version
1.26.12-2.el9
This is the first release that contains the fix.
sudo dnf update python3.11-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the package to the latest version is the recommended solution.
Conclusion
In conclusion, the python3.11-urllib3 package is affected by a moderate security vulnerability related to the handling of cookie request headers during cross-origin redirects. To mitigate this issue, it is recommended to update the package to version 1.26.12-2.el9 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3.11-urllib3 →
FAQ
Python-urllib3 is a Python HTTP module that provides connection pooling and file POST abilities for making HTTP requests in Python applications.
The vulnerability allows an attacker to bypass security restrictions and potentially steal sensitive information or perform unauthorized actions.
To fix this vulnerability, update the python3.11-urllib3 package to version 1.26.12-2.el9 or later.
There is no specific workaround mentioned for this vulnerability. Updating the package to the latest version is the recommended solution.
You can find more information about this vulnerability in the CVE page(s) listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-urllib3.
