Skip to content
OpenAdvisories
Critical RHSA-2020:2068 4 CVEs

Red Hat Security Advisory: python-pip security update

Published Sep 18, 2024 · Updated Mar 23, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client python-pip 0:9.0.3-7.el7_8
Red Hat · RHEL 7 enterprise_linux:7::client python3-pip 0:9.0.3-7.el7_8
Red Hat · RHEL 7 enterprise_linux:7::computenode python-pip 0:9.0.3-7.el7_8
Red Hat · RHEL 7 enterprise_linux:7::computenode python3-pip 0:9.0.3-7.el7_8
Red Hat · RHEL 7 enterprise_linux:7::server python-pip 0:9.0.3-7.el7_8
Red Hat · RHEL 7 enterprise_linux:7::server python3-pip 0:9.0.3-7.el7_8
Red Hat · RHEL 7 enterprise_linux:7::workstation python-pip 0:9.0.3-7.el7_8
Red Hat · RHEL 7 enterprise_linux:7::workstation python3-pip 0:9.0.3-7.el7_8

Vulnerabilities 4

  • Critical 9.8
    CVE-2018-20060

    Exposure of Sensitive Information to an Unauthorized Actor in urllib3

    urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended h…

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI
  • High 7.5
    CVE-2018-18074 Public exploit

    Insufficiently Protected Credentials in Requests

    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

    python-pip requests requests requests Debian Ubuntu PyPI
  • High 7.5
    CVE-2019-11324

    Improper Certificate Validation in urllib3

    The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the cor…

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2019-11236

    Improper Neutralization of CRLF Sequences in urllib3 library for Python

    In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

    urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1643829
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1649153
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1700824
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1702473
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2068.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-18074
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-18074
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-18074
  • report
    https://access.redhat.com/security/cve/CVE-2018-20060
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-20060
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-20060
  • report
    https://access.redhat.com/security/cve/CVE-2019-11236
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11236
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11236
  • report
    https://access.redhat.com/security/cve/CVE-2019-11324
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11324
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11324
  • article
    https://www.openwall.com/lists/oss-security/2019/04/17/3