Medium ELSA-2021-1631 1 CVE

Moderate: python-urllib3 security update (Oracle Linux 8)

Published May 25, 2021 · Updated May 25, 2021

Ecosystem: Oracle Linux

Summary

[1.24.2-5.0.1]
- set RECENT_DATE to 01/30/2019 to make checks happy [Orabug: 30228991]

[1.24.2-5]
- Security fix for CVE-2020-26137
Resolves: rhbz#1883889

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	python3-urllib3	0:1.24.2-5.0.1.el8

Vulnerabilities 1

Medium 6.5

CVE-2020-26137

CRLF injection in urllib3

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Alpine PyPI

Sep 29, 2020