Summary
Dennis Brinkrolf and Tobias Funke discovered that Requests incorrectly
leaked Proxy-Authorization headers. A remote attacker could possibly use
this issue to obtain sensitive information. This update addresses the issue
in the Requests module bundled into pip in Ubuntu 22.04 LTS.
(CVE-2023-32681)
It was discovered that urllib3 didn't strip HTTP body on status code
303 redirects under certain circumstances. A remote attacker could
possibly use this issue to obtain sensitive information. This update
addresses the issue in the urllib3 module bundled into pip in Ubuntu
24.04 LTS. (CVE-2023-45803)
Guido Vranken discovered that idna did not properly manage certain inputs,
which could lead to significant resource consumption. An attacker could
possibly use this issue to cause a denial of service. This update addresses
the issue in the idna module bundled into pip in Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-3651)
Juho Forsén discovered that Requests did not correctly parse URLs. A
remote attacker could possibly use this issue to leak sensitive
information. This update addresses the issue in the Requests module bundled
into pip in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.04.
(CVE-2024-47081)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.3 |
Vulnerabilities 4
-
Medium 6.2CVE-2024-3651 Public exploit
Denial of Service via Quadratic Complexity in kjd/idna
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…
-
Medium 6.1CVE-2023-32681 Public exploit
Unintended leak of Proxy-Authorization header in requests
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header…
-
Medium 5.3
Requests vulnerable to .netrc credentials leak via malicious URLs
Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Reques…
-
Medium 4.2
Request body not stripped after redirect in urllib3
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body…