| Description: | Summary:
The remote host is missing an update for the Debian 'python-urllib3' package(s) announced via the DLA-3610-1 advisory.
Vulnerability Insight:
Security vulnerabilities were found in python-urllib3, an HTTP library with thread-safe connection pooling for Python, which could lead to information disclosure or authorization bypass.
CVE-2018-25091
Yoshida Katsuhiko discovered that the fix for CVE-2018-20060 did not cover non-titlecase request headers, for instance 'authorization' request headers were not removed during during cross-origin redirects. (Per RFC7230 sec. 3.2 header fields are to be treated case-insensitively.)
CVE-2019-11236
Hanno Bock discovered that an attacker controlling the request parameter can inject headers by injecting CR/LF chars. The issue is similar to CPython's CVE-2019-9740.
CVE-2019-11324
Christian Heimes discovered that when verifying HTTPS connections upon passing an SSLContext to urllib3, system CA certificates are loaded into the SSLContext by default in addition to any manually-specified CA certificates. This causes TLS handshakes that should fail given only the manually specified certs to succeed based on system CA certs.
CVE-2020-26137
It was discovered that CRLF injection was possible if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). The issue is similar to urllib's CVE-2020-26116.
CVE-2023-43804
It was discovered that the Cookie request header isn't stripped during cross-origin redirects. It is therefore possible for a user specifying a Cookie header to unknowingly leak information via HTTP redirects to a different origin (unless the user disables redirects explicitly). The issue is similar to CVE-2018-20060, but for Cookie request header rather than Authorization.
For Debian 10 buster, these problems have been fixed in version 1.24.1-1+deb10u1.
We recommend that you upgrade your python-urllib3 packages.
For the detailed security status of python-urllib3 please refer to its security tracker page at: [link moved to references]
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references]
Affected Software/OS:
'python-urllib3' package(s) on Debian 10.
Solution:
Please install the updated package(s).
CVSS Score:
6.4
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
|
