UBUNTU-CVE-2023-43804

Description

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

CVSS Metrics

• v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Systems

• ubuntu•python-pip

  all | < 8.1.1-2ubuntu0.6+esm6 | < 9.0.1-2.3~ubuntu1.18.04.8+esm2 | < 20.0.2-5ubuntu1.10 | < 22.0.2+dfsg-1ubuntu0.4

• ubuntu•python-urllib3

  all | < 1.13.1-2ubuntu0.16.04.4+esm1 | < 1.22-1ubuntu0.18.04.2+esm1 | < 1.25.8-2ubuntu0.3 | < 1.26.5-1~exp1ubuntu0.1

References (5)

• https://ubuntu.com/security/CVE-2023-43804
• https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
• https://ubuntu.com/security/notices/USN-6473-1
• https://ubuntu.com/security/notices/USN-6473-2
• https://www.cve.org/CVERecord?id=CVE-2023-43804