USN-3990-1

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-3990-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3990-1.json

JSON Data

https://api.osv.dev/v1/vulns/USN-3990-1

Related

Published

2019-05-21T13:58:12.450046Z

Modified

2019-05-21T13:58:12.450046Z

Summary

python-urllib3 vulnerabilities

Details

It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20060)

It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. (CVE-2019-11236)

It was discovered that urllib3 incorrectly handled situations where a desired set of CA certificates were specified. This could result in certificates being accepted by the default CA certificates contrary to expectations. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-11324)

References

Affected packages

Ubuntu:16.04:LTS / python-urllib3

Package

Name: python-urllib3
Purl: pkg:deb/ubuntu/python-urllib3?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.13.1-2ubuntu0.16.04.3

Affected versions

1.*

1.11-1

1.12-1

1.13.1-1

1.13.1-2

1.13.1-2ubuntu0.16.04.1

1.13.1-2ubuntu0.16.04.2

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.13.1-2ubuntu0.16.04.3",
            "binary_name": "python-urllib3"
        },
        {
            "binary_version": "1.13.1-2ubuntu0.16.04.3",
            "binary_name": "python3-urllib3"
        }
    ]
}

Ubuntu:18.04:LTS / python-urllib3

Package

Name: python-urllib3
Purl: pkg:deb/ubuntu/python-urllib3?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.22-1ubuntu0.18.04.1

Affected versions

1.*

1.21.1-1

1.22-1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1.22-1ubuntu0.18.04.1",
            "binary_name": "python-urllib3"
        },
        {
            "binary_version": "1.22-1ubuntu0.18.04.1",
            "binary_name": "python3-urllib3"
        }
    ]
}