Red Hat Security Advisory: python-urllib3 security update

Fixed packages 2

Vulnerabilities 2

• Medium 5.9
  CVE-2023-43804 Public exploit

  `Cookie` HTTP header isn't stripped on cross-origin redirects

  urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

  urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 4, 2023
• Medium 4.2
  CVE-2023-45803

  Request body not stripped after redirect in urllib3

  urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body…

  urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 17, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242493
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246840
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0300.json
• report
  https://access.redhat.com/security/cve/CVE-2023-43804
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43804
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43804
• report
  https://access.redhat.com/security/cve/CVE-2023-45803
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45803
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45803
• article
  https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9
• article
  https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4
• article
  https://www.rfc-editor.org/rfc/rfc9110.html#name-get