Medium ELSA-2024-8843 1 CVE

Moderate: python3.11-urllib3 security update (Oracle Linux 8)

Published Nov 5, 2024 · Updated Nov 5, 2024

Ecosystem: Oracle Linux

Summary

[1.26.12-4]
- Fix test_ssltransport for changes in ssl.SSLSocket in Python 3.11.3
Related: RHEL-59995

[1.26.12-3]
- Security fix for CVE-2024-37891
Resolves: RHEL-59995

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	python3.11-urllib3	0:1.26.12-4.el8_10

Vulnerabilities 1

Medium 4.4

CVE-2024-37891

Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…

urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI

Jun 17, 2024