Skip to content
OpenAdvisories
Medium ELSA-2020-2081 3 CVEs

Moderate: python-virtualenv security update (Oracle Linux 7)

Published May 19, 2020 · Updated May 19, 2020

Ecosystem: Oracle Linux

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 python-virtualenv 0:15.1.0-4.el7_8

Vulnerabilities 3

  • Critical 9.8
    CVE-2018-20060

    Exposure of Sensitive Information to an Unauthorized Actor in urllib3

    urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended h…

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI
  • High 7.5
    CVE-2018-18074 Public exploit

    Insufficiently Protected Credentials in Requests

    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

    python-pip requests requests requests Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2019-11236

    Improper Neutralization of CRLF Sequences in urllib3 library for Python

    In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI