Skip to content
OpenAdvisories
Medium RHSA-2024:2986 1 CVE

Red Hat Security Advisory: python3.11-urllib3 security update

Published Sep 18, 2024 · Updated Aug 8, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream python3.11-urllib3 0:1.26.12-2.el8

Vulnerabilities 1

  • Medium 5.9
    CVE-2023-43804 Public exploit

    `Cookie` HTTP header isn't stripped on cross-origin redirects

    urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

    urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2242493
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2986.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-43804
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-43804
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-43804