Summary
[1.26.5-5.1]
- Security fix for CVE-2024-37891
- Backport upstream patch to fix TypeError for http connection if the PoolManager
- is instantiated with server_hostname
Resolves: RHEL-49853
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python3-urllib3 | 0:1.26.5-5.el9_4.1 |
Vulnerabilities 1
-
Medium 4.4
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…