Lucene search

K
almalinuxAlmaLinuxALSA-2024:2159
HistoryApr 30, 2024 - 12:00 a.m.

Moderate: python3.11-urllib3 security update

2024-04-3000:00:00
errata.almalinux.org
19
python http module
connection pooling
security update
cve-2023-43804
almalinux release notes

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

39.2%

The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities.

Security Fix(es):

  • python-urllib3: Cookie request header isn’t stripped during cross-origin redirects (CVE-2023-43804)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
almalinux9noarchpython3.11-urllib3< 1.26.12-2.el9python3.11-urllib3-1.26.12-2.el9.noarch.rpm

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

39.2%