Skip to content
OpenAdvisories
High RHSA-2019:3590 2 CVEs

Red Hat Security Advisory: python-urllib3 security update

Published Sep 18, 2024 · Updated Mar 23, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos python-urllib3 0:1.24.2-2.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos python3-urllib3 0:1.24.2-2.el8

Vulnerabilities 2

  • High 7.5
    CVE-2019-11324

    Improper Certificate Validation in urllib3

    The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the cor…

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2019-11236

    Improper Neutralization of CRLF Sequences in urllib3 library for Python

    In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1700824
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1702473
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3590.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-11236
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11236
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11236
  • report
    https://access.redhat.com/security/cve/CVE-2019-11324
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11324
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11324
  • article
    https://www.openwall.com/lists/oss-security/2019/04/17/3