Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.5788
python-urllib3 security update
9 October 2023
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: python-urllib3
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2023-43804 CVE-2020-26137 CVE-2020-26116
CVE-2019-11324 CVE-2019-11236 CVE-2019-9740
CVE-2018-20060
Original Bulletin:
http://www.debian.org/lts/security/2023/dla-3610
Comment: CVSS (Max): 9.8 CVE-2018-20060 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: GitHub, [NIST]
Calculator: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3610-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Guilhem Moulin
October 08, 2023 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : python-urllib3
Version : 1.24.1-1+deb10u1
CVE ID : CVE-2019-11236 CVE-2019-11324 CVE-2020-26137 CVE-2023-43804
Debian Bug : 927172 927412 1053626
Security vulnerabilities were found in python-urllib3, an HTTP library
with thread-safe connection pooling for Python, which could lead to
information disclosure or authorization bypass.
CVE-2019-11236
Hanno B=C3=B6ck discovered that an attacker controlling the request
parameter can inject headers by injecting CR/LF chars. The issue is
similar to CPython's CVE-2019-9740.
CVE-2019-11324
Christian Heimes discovered that when verifying HTTPS connections
upon passing an SSLContext to urllib3, system CA certificates are
loaded into the SSLContext by default in addition to any
manually-specified CA certificates.
This causes TLS handshakes that should fail given only the manually
specified certs to succeed based on system CA certs.
CVE-2020-26137
It was discovered that CRLF injection was possible if the attacker
controls the HTTP request method, as demonstrated by inserting CR
and LF control characters in the first argument of putrequest().
The issue is similar to urllib's CVE-2020-26116.
CVE-2023-43804
It was discovered that the Cookie request header isn't stripped
during cross-origin redirects. It is therefore possible for a user
specifying a Cookie header to unknowingly leak information via HTTP
redirects to a different origin (unless the user disables redirects
explicitly). The issue is similar to CVE-2018-20060, but for Cookie
request header rather than Authorization.
Moreover authorization request headers were not removed
redirecting to cross-site. Per RFC7230 sec. 3.2 header fields are
to be treated case-insensitively.
For Debian 10 buster, these problems have been fixed in version
1.24.1-1+deb10u1.
We recommend that you upgrade your python-urllib3 packages.
For the detailed security status of python-urllib3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-urllib3
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmUijSoACgkQ05pJnDwh
pVIOdQ//WQjF14lGYvGVzSS0PWBbyZgyIlXMCRMxayltVq0S/rYyaTpKPvWcXadK
IgIoPx4XaUNMBCnJ+cMccS6AJUhBhdL7lr8M6y7C1WczFie/EL/GrShzwZP645Gf
RbDp7dCu+QS5T0leydZur6lafTyZiYDt1GJrgloK3nRuQ+tU7tjndz1J9yXZx08o
Oo+dxsFsvtdFAKlieSSzwKUeH3UT/A3TYxZSzHggYEfmV2AIfFQx58X3FcGlnQFt
Rr05iHLEpnToOQdKGhilMqaJSA5TMjQC6TBhpIRsaJvvue6mrB40a+v1NY8s9H6C
TvdrD3EUaM3aa2CbdmjZUd4LRYT6UwZPg161JXd8SC1QIXF/dtd3e6mHQANejJRw
l7tibgPdD16nwkNTfN2UURtu8GFS/AYnNPFaY281+hqrSrPUqCGeqI0hSlHZF19q
RKMSwG6uuqAsfKz+Gx5mY0EV6hjflBUs61miZniie8ijV5Nemc7cPAhH4TYLom5n
uXcv4uh3ruT1tLlp+kTEDT6vlQ5HtStaEnOKAAcxDXFAifb5dq2Mm0mBH8WU8G0o
6Kva7dJJn6FdUuY2+c3Ktv9vHu5Kuhl9ovzJXerDMl4EwH4KQqDZCVAn6I9w4V2x
itv51XXEhe9AZ7hgZvG2yP9Ps36N2CaKYKxNf6DWcNavX12iuRU=
=GC+N
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZSNnmskNZI30y1K9AQguHRAArR0/EJ2T6l5P5OKQvlTHmmyzjSoyWq1o
rsotr2CE+DS+9jXYGEcYFIXy0a/3wCfPujS3pOlAWEVOZt0adUYpbsaV+3csIscl
G+9vaF7Ie1L51WODLZzIOFbQRllealQD9eUnI18QSa+3COg/oL55UltufaN75IPp
b0ew6bBDWvNrlYC5FnFXSzCnw883zscA4vA2fxvMkJxc5LDXihS1iG0z2W5jI5cn
zySsaBdwQVHtuY+heY4DaDbcAyCSvxz78gqKYovJciGu8jdrI85zqnuGVJ5wk6AA
BujpQ9onEWjuFvP9GQ22hNe41HrLx++XVh0XxzCP9TaKJp/bQIOKC/fuFtorWgrM
xqn/dkMqv80oiFY+c6XXHwKC4PTlFuO7np5J+esp2hB761K1qCzgEdRrcejb5WbP
a/9KBD3z/2/ZIXoMaYfQZh3QIk/VMsth8D4wG5IE/CL8HRxTq3MvBZJayGLUrgvF
PmpKtmCbEj7tTJ0V8JSPwxx42IXPLtvSQT5zbKQvr5WuH4QhpwvaoJZSSs5A/VEv
grRMxpETpz7+CpKFaooB2Jmne+lVyu/gQwf0PhOIrdbh5hCQP3KyHQNKYFTCqWgH
c4L6lS7fMoMaoGFPih7vZWXuMRIVI/7289LLYVHZtWf+ZEcKEdBavZKflzlv/000
k7LKWo7F5a4=
=bg51
-----END PGP SIGNATURE-----