Red Hat Security AdvisoryRHSA-2020:0851
python-virtualenv security update
Released 2020-03-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) python-virtualenv-15.1.0-4.el7_7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-virtualenv-15.1.0-4.el7_7
- Red Hat Enterprise Linux Server (v. 7) python-virtualenv-15.1.0-4.el7_7
- Red Hat Enterprise Linux Workstation (v. 7) python-virtualenv-15.1.0-4.el7_7
Fixes 3 records
Priority MEDIUM 49
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme).
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04488 · Published 2018-12-11 · Partial fix · 1.23 CWE-200
Priority MEDIUM 43
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06925 · Published 2018-10-09 · Partial fix · 2.20.0 CWE-522
Priority LOW 31
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02073 · Published 2019-04-15 · Partial fix · 1.24.3 CWE-93
