Security Update for python-urllib3
Summary
DLA-3610-1: python-urllib3 - security update. Affects python-urllib3 versions < 1.24.1-1+deb10u1. Fixed in 1.24.1-1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-urllib3 is an HTTP library for Python that provides thread-safe connection pooling. It is widely used for making HTTP requests and handling responses. However, several security vulnerabilities have been discovered in python-urllib3, which could lead to information disclosure or authorization bypass.
Vulnerability Detail
The vulnerabilities in python-urllib3 include:
-
CVE-2018-25091: The fix for CVE-2018-20060 did not cover non-titlecase request headers, allowing unauthorized headers to be retained during cross-origin redirects.
-
CVE-2019-11236: Attackers can inject headers by manipulating request parameters and injecting CR/LF characters, similar to CPython's CVE-2019-9740.
-
CVE-2019-11324: When verifying HTTPS connections, system CA certificates are loaded by default in addition to manually-specified CA certificates, leading to successful TLS handshakes that should fail.
-
CVE-2020-26137: CRLF injection is possible if the attacker controls the HTTP request method, allowing the insertion of control characters in the first argument of
putrequest(). -
CVE-2023-43804: The
Cookierequest header is not stripped during cross-origin redirects, potentially leaking information via HTTP redirects to a different origin.
How To Fix
Minimum fixed version
1.24.1-1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
It is crucial to update your python-urllib3 packages to the recommended version to mitigate the security vulnerabilities. Failure to do so may result in information disclosure or unauthorized access to sensitive data. For further assistance, please reach out to DevNack.com.
See every vulnerability recorded for python-urllib3 →
FAQ
python-urllib3 is an HTTP library for Python that provides thread-safe connection pooling and is commonly used for making HTTP requests.
These vulnerabilities could lead to information disclosure or unauthorized access to sensitive data.
There are no known exploits mentioned in the vulnerability details.
You can use the Vulert Playground at Vulert Scanner to check if your python-urllib3 version is affected by these vulnerabilities.
For further support on vulnerability remediation, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for python-urllib3.
