Read the docs
TI-2023-23495 Aliases CVE-2023-43804GHSA-v845-jxx5-vc9f

`Cookie` HTTP header isn't stripped on cross-origin redirects

Priority LOW 38CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 41 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

Why it matters now

EPSS 0.0136 71st percentileScored 2026-11-07
Fix Partial urllib3 (urllib3): 2.0.6, 1.26.17urllib3 (PyPI): 2.0.6, 1.26.17Red Hat: 22 advisoriesRed Hat: 41 fixed, 10 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
python-pillowurllib32.0.0 to before 2.0.6; before 1.26.172.0.6, 1.26.17Patch availableCNA
—urllib3 (PyPI)2.0.0 to before 2.0.62.0.6Patch availableGHSA-v845-jxx5-vc9f
—urllib3 (PyPI)before 1.26.171.26.17Patch availableGHSA-v845-jxx5-vc9f
  • urllib3 Vendorpython-pillow Affected 2.0.0 to before 2.0.6; before 1.26.17 Fixed in 2.0.6, 1.26.17 Patch available CNA
  • urllib3 (PyPI) Vendor— Affected 2.0.0 to before 2.0.6 Fixed in 2.0.6 Patch available GHSA-v845-jxx5-vc9f
  • urllib3 (PyPI) Vendor— Affected before 1.26.17 Fixed in 1.26.17 Patch available GHSA-v845-jxx5-vc9f

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*before 1.26.17; 2.0.0 to before 2.0.6Vulnerablepython-pillow
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
  • cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions before 1.26.17; 2.0.0 to before 2.0.6 Vulnerable ·python-pillow
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA urllib3 (urllib3) Fixed in 2.0.6, 1.26.17
  • Fix · GHSA-v845-jxx5-vc9f urllib3 (PyPI) Fixed in 2.0.6 Advisory →
  • Fix · GHSA-v845-jxx5-vc9f urllib3 (PyPI) Fixed in 1.26.17 Advisory →

Red Hat 22 advisories

  • RHSA-2024:2987 Released 2024-05-22 · Red Hat rating Moderate
    python27:2.7 security update
    • Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.9.0+19487+7dc18407.src::python27:2.7, PyYAML-3.12-16.module+el8.9.0+19487+7dc18407.src::python27:2.7, babel-2.5.1-10.module+el8.9.0+19487+7dc18407.noarch::python27:2.7 +47
  • RHSA-2024:2986 Released 2024-05-22 · Red Hat rating Moderate
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.11-urllib3-1.26.12-2.el8
  • RHSA-2024:2985 Released 2024-05-22 · Red Hat rating Moderate
    python39:3.9 and python39-devel:3.9 security update
    • Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.9.0+19644+d68f775d.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
    • Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
Show 19 more Red Hat advisories
  • RHSA-2024:2159 Released 2024-04-30 · Red Hat rating Moderate
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-urllib3-1.26.12-2.el9
  • RHSA-2024:1383 Released 2024-03-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
    • RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
  • RHSA-2024:0733 Released 2024-02-07 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-core-1:2.15.9-1.el8ap, automation-controller-venv-tower-4.5.1-1.el8ap
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-core-1:2.15.9-1.el9ap, automation-controller-venv-tower-4.5.1-1.el9ap
  • RHSA-2024:0588 Released 2024-01-30 · Red Hat rating Moderate
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) python-urllib3-1.24.2-5.el8_8.1, python3-urllib3-1.24.2-5.el8_8.1
  • RHSA-2024:0464 Released 2024-01-25 · Red Hat rating Moderate
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3-1.26.5-3.el9_3.1, python3-urllib3-1.26.5-3.el9_3.1
  • RHSA-2024:0300 Released 2024-01-18 · Red Hat rating Moderate
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) python-urllib3-1.24.2-5.el8_6.1, python3-urllib3-1.24.2-5.el8_6.1
  • RHSA-2024:0187 Released 2024-01-16 · Red Hat rating Moderate
    Red Hat OpenStack Platform 17.1 (python-urllib3) security update
    • Red Hat OpenStack Platform 17.1 python-urllib3-1.25.10-5.el8ost, python3-urllib3-1.25.10-5.el8ost
  • RHSA-2024:0133 Released 2024-01-10 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-121.el8_9.2, fence-agents-all-4.2.1-121.el8_9.2, fence-agents-amt-ws-4.2.1-121.el8_9.2 +40
    • Red Hat Enterprise Linux High Availability (v. 8) fence-agents-aliyun-4.2.1-121.el8_9.2, fence-agents-aws-4.2.1-121.el8_9.2, fence-agents-azure-arm-4.2.1-121.el8_9.2 +2
    • Red Hat Enterprise Linux Resilient Storage (v. 8) fence-agents-aliyun-4.2.1-121.el8_9.2, fence-agents-aws-4.2.1-121.el8_9.2, fence-agents-azure-arm-4.2.1-121.el8_9.2 +2
  • RHSA-2024:0116 Released 2024-01-10 · Red Hat rating Moderate
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) python-urllib3-1.24.2-5.el8_9.2, python3-urllib3-1.24.2-5.el8_9.2
  • RHSA-2023:7851 Released 2023-12-14 · Red Hat rating Moderate
    Satellite 6.14.1 Async Security Update
    • Red Hat Satellite 6.14 for RHEL 8 createrepo_c-1.0.2-2.el8pc, createrepo_c-libs-1.0.2-2.el8pc, foreman-3.7.0.10-1.el8sat +47
  • RHSA-2023:7753 Released 2023-12-12 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-55.el9_3.2, fence-agents-common-4.10.0-55.el9_3.2, fence-agents-compute-4.10.0-55.el9_3.2 +11
    • Red Hat Enterprise Linux High Availability (v. 9) fence-agents-aliyun-4.10.0-55.el9_3.2, fence-agents-all-4.10.0-55.el9_3.2, fence-agents-amt-ws-4.10.0-55.el9_3.2 +39
    • Red Hat Enterprise Linux Resilient Storage (v. 9) fence-agents-aliyun-4.10.0-55.el9_3.2, fence-agents-all-4.10.0-55.el9_3.2, fence-agents-amt-ws-4.10.0-55.el9_3.2 +39
  • RHSA-2023:7528 Released 2023-11-28 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) fence-agents-4.2.1-112.el8_8.2, fence-agents-all-4.2.1-112.el8_8.2, fence-agents-amt-ws-4.2.1-112.el8_8.2 +40
    • Red Hat Enterprise Linux High Availability EUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.2, fence-agents-aws-4.2.1-112.el8_8.2, fence-agents-azure-arm-4.2.1-112.el8_8.2 +2
    • Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.2, fence-agents-aws-4.2.1-112.el8_8.2, fence-agents-azure-arm-4.2.1-112.el8_8.2 +2
  • RHSA-2023:7523 Released 2023-11-28 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.13, fence-agents-all-4.2.1-65.el8_4.13, fence-agents-amt-ws-4.2.1-65.el8_4.13 +39
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) fence-agents-4.2.1-65.el8_4.13, fence-agents-all-4.2.1-65.el8_4.13, fence-agents-amt-ws-4.2.1-65.el8_4.13 +40
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) fence-agents-4.2.1-65.el8_4.13, fence-agents-all-4.2.1-65.el8_4.13, fence-agents-amt-ws-4.2.1-65.el8_4.13 +39
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.13, fence-agents-aws-4.2.1-65.el8_4.13, fence-agents-azure-arm-4.2.1-65.el8_4.13 +1
    • Red Hat Enterprise Linux HighAvailability E4S (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.13, fence-agents-aws-4.2.1-65.el8_4.13, fence-agents-azure-arm-4.2.1-65.el8_4.13 +1
    • Red Hat Enterprise Linux HighAvailability TUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.13, fence-agents-aws-4.2.1-65.el8_4.13, fence-agents-azure-arm-4.2.1-65.el8_4.13 +1
  • RHSA-2023:7435 Released 2023-11-21 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) fence-agents-4.2.1-41.el8_2.12, fence-agents-all-4.2.1-41.el8_2.12, fence-agents-amt-ws-4.2.1-41.el8_2.12 +35
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) fence-agents-4.2.1-41.el8_2.12, fence-agents-all-4.2.1-41.el8_2.12, fence-agents-amt-ws-4.2.1-41.el8_2.12 +36
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) fence-agents-4.2.1-41.el8_2.12, fence-agents-all-4.2.1-41.el8_2.12, fence-agents-amt-ws-4.2.1-41.el8_2.12 +35
    • Red Hat Enterprise Linux High Availability E4S (v. 8.2) fence-agents-aliyun-4.2.1-41.el8_2.12, fence-agents-aws-4.2.1-41.el8_2.12, fence-agents-azure-arm-4.2.1-41.el8_2.12 +1
    • Red Hat Enterprise Linux High Availability TUS (v. 8.2) fence-agents-aliyun-4.2.1-41.el8_2.12, fence-agents-aws-4.2.1-41.el8_2.12, fence-agents-azure-arm-4.2.1-41.el8_2.12 +1
  • RHSA-2023:7407 Released 2023-11-21 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) fence-agents-4.2.1-89.el8_6.10, fence-agents-all-4.2.1-89.el8_6.10, fence-agents-amt-ws-4.2.1-89.el8_6.10 +40
    • Red Hat Enterprise Linux High Availability EUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.10, fence-agents-aws-4.2.1-89.el8_6.10, fence-agents-azure-arm-4.2.1-89.el8_6.10 +1
    • Red Hat Enterprise Linux Resilient Storage EUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.10, fence-agents-aws-4.2.1-89.el8_6.10, fence-agents-azure-arm-4.2.1-89.el8_6.10 +1
  • RHSA-2023:7385 Released 2023-11-21 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) fence-agents-4.10.0-20.el9_0.10, fence-agents-common-4.10.0-20.el9_0.10, fence-agents-compute-4.10.0-20.el9_0.10 +12
    • Red Hat Enterprise Linux High Availability EUS (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.10, fence-agents-all-4.10.0-20.el9_0.10, fence-agents-amt-ws-4.10.0-20.el9_0.10 +39
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.10, fence-agents-all-4.10.0-20.el9_0.10, fence-agents-amt-ws-4.10.0-20.el9_0.10 +39
  • RHSA-2023:7378 Released 2023-11-21 · Red Hat rating Moderate
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) fence-agents-4.10.0-43.el9_2.2, fence-agents-common-4.10.0-43.el9_2.2, fence-agents-compute-4.10.0-43.el9_2.2 +11
    • Red Hat Enterprise Linux High Availability EUS (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.2, fence-agents-all-4.10.0-43.el9_2.2, fence-agents-amt-ws-4.10.0-43.el9_2.2 +39
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.2, fence-agents-all-4.10.0-43.el9_2.2, fence-agents-amt-ws-4.10.0-43.el9_2.2 +39
  • RHSA-2023:6812 Released 2023-11-08 · Red Hat rating Moderate
    fence-agents bug fix, enhancement, and security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) fence-agents-4.2.1-30.el8_1.10, fence-agents-all-4.2.1-30.el8_1.10, fence-agents-amt-ws-4.2.1-30.el8_1.10 +36
    • Red Hat Enterprise Linux High Availability E4S (v. 8.1) fence-agents-aliyun-4.2.1-30.el8_1.10, fence-agents-aws-4.2.1-30.el8_1.10, fence-agents-azure-arm-4.2.1-30.el8_1.10 +1
  • RHSA-2023:6158 Released 2023-10-30 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.4.7-1.el8ap, python39-urllib3-1.26.18-1.el8ap, python3x-urllib3-1.26.18-1.el8ap
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.4.7-1.el9ap, python-urllib3-1.26.18-1.el9ap, python3-urllib3-1.26.18-1.el9ap

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Certification for Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Data Science (RHODS)AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Out of support scope
Red Hat Satellite 6AffectedNo fix yet
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
Quay v3Fixed—
RHODF 4.15 for RHEL 9Fixed RHSA-2024:1383
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2023:6158, RHSA-2024:0733
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2023:6158, RHSA-2024:0733
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:0133, RHSA-2024:2985, RHSA-2024:2986, RHSA-2024:2987
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:7753, RHSA-2024:2159
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2023:7435
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2023:7523
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2023:6812
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2023:7435
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2023:7523
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:7407
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2023:7528
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2023:7385
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2023:7378
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2023:7435
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2023:7523
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:0116
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:0464
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2024:0300
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:0588
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2024:2985
Red Hat Enterprise Linux High Availability (v. 8)Fixed RHSA-2024:0133
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2023:7753
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2023:7523
Red Hat Enterprise Linux High Availability E4S (v. 8.1)Fixed RHSA-2023:6812
Red Hat Enterprise Linux High Availability E4S (v. 8.2)Fixed RHSA-2023:7435
Red Hat Enterprise Linux High Availability EUS (v.8.6)Fixed RHSA-2023:7407
Red Hat Enterprise Linux High Availability EUS (v.8.8)Fixed RHSA-2023:7528
Red Hat Enterprise Linux High Availability EUS (v.9.0)Fixed RHSA-2023:7385
Red Hat Enterprise Linux High Availability EUS (v.9.2)Fixed RHSA-2023:7378
Red Hat Enterprise Linux High Availability TUS (v. 8.2)Fixed RHSA-2023:7435
Red Hat Enterprise Linux HighAvailability E4S (v.8.4)Fixed RHSA-2023:7523
Red Hat Enterprise Linux HighAvailability TUS (v.8.4)Fixed RHSA-2023:7523
Red Hat Enterprise Linux Resilient Storage (v. 8)Fixed RHSA-2024:0133
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2023:7753
Red Hat Enterprise Linux Resilient Storage EUS (v.8.6)Fixed RHSA-2023:7407
Red Hat Enterprise Linux Resilient Storage EUS (v.8.8)Fixed RHSA-2023:7528
Red Hat Enterprise Linux Resilient Storage EUS (v.9.0)Fixed RHSA-2023:7385
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2)Fixed RHSA-2023:7378
Red Hat OpenStack Platform 17.1Fixed RHSA-2024:0187
Not affected: 5 products
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-43804
  2. 2026-10-03 Alias added: GHSA-v845-jxx5-vc9f

References

Patch 3

Advisory 5

Other 8

  • TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
  • TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
  • TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
  • TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
  • TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
  • TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences