Skip to content
OpenAdvisories
Medium ELSA-2019-2272 2 CVEs

Moderate: python-urllib3 security update (Oracle Linux 7)

Published Aug 13, 2019 · Updated Aug 13, 2019

Ecosystem: Oracle Linux

Summary

[1.10.2-7]
- Provide python2-urllib3
- Add patch for CVE-2019-11236
Resolves: rhbz#1703360

[1.10.2-6]
- Source URL switched to HTTPS protocol
- Add patch for CVE-2018-20060
Resolves: rhbz#1658471

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 python-urllib3 0:1.10.2-7.el7

Vulnerabilities 2

  • Critical 9.8
    CVE-2018-20060

    Exposure of Sensitive Information to an Unauthorized Actor in urllib3

    urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended h…

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2019-11236

    Improper Neutralization of CRLF Sequences in urllib3 library for Python

    In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI