USN-6473-1 fixed vulnerabilities in urllib3. This update provides the corresponding updates for the urllib3 module bundled into pip.
Original advisory details:
It was discovered that urllib3 didn't strip HTTP Authorization header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-25091)
It was discovered that urllib3 didn't strip HTTP Cookie header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-43804)
It was discovered that urllib3 didn't strip HTTP body on status code 303 redirects under certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-45803)
{ "binaries": [ { "binary_name": "python-pip", "binary_version": "8.1.1-2ubuntu0.6+esm6" }, { "binary_name": "python-pip-whl", "binary_version": "8.1.1-2ubuntu0.6+esm6" }, { "binary_name": "python3-pip", "binary_version": "8.1.1-2ubuntu0.6+esm6" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro" }
{ "binaries": [ { "binary_name": "python-pip", "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm2" }, { "binary_name": "python-pip-whl", "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm2" }, { "binary_name": "python3-pip", "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm2" } ], "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro" }