USN-3990-1

See a problem?
Source
https://ubuntu.com/security/notices/USN-3990-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3990-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-3990-1
Related
Published
2019-05-21T13:58:12.450046Z
Modified
2019-05-21T13:58:12.450046Z
Summary
python-urllib3 vulnerabilities
Details

It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20060)

It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. (CVE-2019-11236)

It was discovered that urllib3 incorrectly handled situations where a desired set of CA certificates were specified. This could result in certificates being accepted by the default CA certificates contrary to expectations. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-11324)

References

Affected packages

Ubuntu:16.04:LTS / python-urllib3

Package

Name
python-urllib3
Purl
pkg:deb/ubuntu/python-urllib3@1.13.1-2ubuntu0.16.04.3?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.13.1-2ubuntu0.16.04.3

Affected versions

1.*

1.11-1
1.12-1
1.13.1-1
1.13.1-2
1.13.1-2ubuntu0.16.04.1
1.13.1-2ubuntu0.16.04.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "python3-urllib3": "1.13.1-2ubuntu0.16.04.3",
            "python-urllib3": "1.13.1-2ubuntu0.16.04.3"
        }
    ]
}

Ubuntu:18.04:LTS / python-urllib3

Package

Name
python-urllib3
Purl
pkg:deb/ubuntu/python-urllib3@1.22-1ubuntu0.18.04.1?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.22-1ubuntu0.18.04.1

Affected versions

1.*

1.21.1-1
1.22-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "python3-urllib3": "1.22-1ubuntu0.18.04.1",
            "python-urllib3": "1.22-1ubuntu0.18.04.1"
        }
    ]
}