Skip to content
OpenAdvisories
Critical RHSA-2019:2272 2 CVEs

Red Hat Security Advisory: python-urllib3 security update

Published Sep 18, 2024 · Updated Mar 23, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client python-urllib3 0:1.10.2-7.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode python-urllib3 0:1.10.2-7.el7
Red Hat · RHEL 7 enterprise_linux:7::server python-urllib3 0:1.10.2-7.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation python-urllib3 0:1.10.2-7.el7

Vulnerabilities 2

  • Critical 9.8
    CVE-2018-20060

    Exposure of Sensitive Information to an Unauthorized Actor in urllib3

    urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended h…

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2019-11236

    Improper Neutralization of CRLF Sequences in urllib3 library for Python

    In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1649153
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1700824
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2272.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-20060
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-20060
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-20060
  • report
    https://access.redhat.com/security/cve/CVE-2019-11236
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11236
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11236