Skip to content
OpenAdvisories
Medium ALAS2023-2023-454 1 CVE

Moderate: python-urllib3 security update (Amazon Linux 2023)

Published Dec 6, 2023 · Updated Dec 14, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-43804: urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 python3-urllib3 0:1.25.10-5.amzn2023.0.3

Vulnerabilities 1

  • Medium 5.9
    CVE-2023-43804 Public exploit

    `Cookie` HTTP header isn't stripped on cross-origin redirects

    urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

    urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-43804.html