UbuntuUpdates.org

Package "python3-urllib3"

Name: python3-urllib3

Description:

HTTP library with thread-safe connection pooling for Python3
Latest version: 1.25.8-2ubuntu0.4
Release: focal (20.04)
Level: security
Repository: main
Head package: python-urllib3
Homepage: https://urllib3.readthedocs.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python3-urllib3"

All arch deb package
APT INSTALL

Other versions of "python3-urllib3" in Focal

Repository Area Version
base main 1.25.8-2
updates main 1.25.8-2ubuntu0.4

Changelog

Version: 1.25.8-2ubuntu0.4 2024-10-29 17:06:57 UTC

  python-urllib3 (1.25.8-2ubuntu0.4) focal-security; urgency=medium

  * SECURITY UPDATE: The Proxy-Authorization header is not correctly stripped
    when redirecting to a different host.
    - debian/patches/CVE-2024-37891.patch: Add "Proxy-Authorization" to
      DEFAULT_REDIRECT_HEADERS_BLACKLIST in src/urllib3/util/retry.py. Add
      header to tests.
    - CVE-2024-37891

 -- Hlib Korzhynskyy <email address hidden> Wed, 16 Oct 2024 17:58:58 -0230
Source diff to previous version
CVE-2024-37891 urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header i

Version: 1.25.8-2ubuntu0.3 2023-11-07 15:14:42 UTC

  python-urllib3 (1.25.8-2ubuntu0.3) focal-security; urgency=medium

  * SECURITY UPDATE: http cookie leakage via http redirect
    - debian/patches/CVE-2023-43804.patch: removes the cookie from the
      http request when it is redirected to a different origin.
    - CVE-2023-43804
  * SECURITY UPDATE: http body leakage via http redirect
    - debian/patches/CVE-2023-45803.patch: removes the body from the
      http request when it is redirected to a different origin and the
      http verb is changed to GET.
    - CVE-2023-45803

 -- Jorge Sancho Larraz <email address hidden> Tue, 24 Oct 2023 21:57:53 +0200
Source diff to previous version
CVE-2023-43804 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing

Version: 1.25.8-2ubuntu0.2 2023-01-19 15:07:22 UTC

  python-urllib3 (1.25.8-2ubuntu0.2) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via URL regex backtracking
    - debian/patches/CVE-2021-33503.patch: improve performance of
      sub-authority splitting in URL in src/urllib3/util/url.py,
      test/test_util.py.
    - CVE-2021-33503

 -- Marc Deslauriers <email address hidden> Wed, 18 Jan 2023 10:50:06 -0500
Source diff to previous version
CVE-2021-33503 An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority reg

Version: 1.25.8-2ubuntu0.1 2020-10-05 19:07:05 UTC

  python-urllib3 (1.25.8-2ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: CRLF injection via method parameter
    - debian/patches/CVE-2020-26137.patch: raise ValueError if method
      contains control characters in src/urllib3/connection.py,
      test/with_dummyserver/test_connectionpool.py.
    - CVE-2020-26137

 -- Marc Deslauriers <email address hidden> Thu, 01 Oct 2020 13:56:51 -0400
CVE-2020-26137 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characte


About   -   Send Feedback to @ubuntu_updates