Summary
USN-7084-1 fixed vulnerability in urllib3. This update provides the
corresponding update for the urllib3 module bundled into pip.
Original advisory details:
It was discovered that urllib3 didn't strip HTTP Proxy-Authorization
header on cross-origin redirects. A remote attacker could possibly use
this issue to obtain sensitive information.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | python-pip | 20.0.2-5ubuntu1.11 |
| Ubuntu · 22.04 LTS 22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.5 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-pip | 8.1.1-2ubuntu0.6+esm10 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-pip | 9.0.1-2.3~ubuntu1.18.04.8+esm6 |
Vulnerabilities 1
-
Medium 4.4
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…
References
-
report
https://ubuntu.com/security/CVE-2024-37891