ALSA-2024:0464

Import Source
https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2024:0464.json
Related
Published
2024-01-25T00:00:00Z
Modified
2024-01-25T21:46:05Z
Details

The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities.

Security Fix(es):

  • python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)
  • urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Affected packages

AlmaLinux:9 / python3-urllib3

Package

Name
python3-urllib3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.26.5-3.el9_3.1