Red Hat Security AdvisoryRHSA-2019:2272
python-urllib3 security update
Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) python-urllib3-1.10.2-7.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) python-urllib3-1.10.2-7.el7
- Red Hat Enterprise Linux Server (v. 7) python-urllib3-1.10.2-7.el7
- Red Hat Enterprise Linux Workstation (v. 7) python-urllib3-1.10.2-7.el7
Fixes 2 records
Priority MEDIUM 49
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme).
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04488 · Published 2018-12-11 · Partial fix · 1.23 CWE-200
Priority LOW 31
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02073 · Published 2019-04-15 · Partial fix · 1.24.3 CWE-93
