CVE-2023-43804
Published: 4 October 2023
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Notes
| Author | Note |
|---|---|
| mdeslaur | On focal and earlier, the python-pip package bundles python-urllib3 binaries when built. After updating python-urllib3, a no-change rebuild of python-pip is required. On jammy and later, python-urllib3 is bundled in the python-pip package and needs to be patched. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
python-urllib3 Launchpad, Ubuntu, Debian |
trusty |
Needs triage
|
| xenial |
Released
(1.13.1-2ubuntu0.16.04.4+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| bionic |
Released
(1.22-1ubuntu0.18.04.2+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| focal |
Released
(1.25.8-2ubuntu0.3)
|
|
| jammy |
Released
(1.26.5-1~exp1ubuntu0.1)
|
|
| lunar |
Released
(1.26.12-1ubuntu0.1)
|
|
| upstream |
Released
(1.26.17)
|
|
| mantic |
Released
(1.26.16-1ubuntu0.1)
|
|
|
Patches: upstream: https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d (2.x) upstream: https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb (1.x) |
||
|
python-pip Launchpad, Ubuntu, Debian |
trusty |
Needs triage
|
| xenial |
Released
(8.1.1-2ubuntu0.6+esm6)
Available with Ubuntu Pro |
|
| bionic |
Released
(9.0.1-2.3~ubuntu1.18.04.8+esm2)
Available with Ubuntu Pro |
|
| focal |
Released
(20.0.2-5ubuntu1.10)
|
|
| jammy |
Released
(22.0.2+dfsg-1ubuntu0.4)
|
|
| lunar |
Released
(23.0.1+dfsg-1ubuntu0.2)
|
|
| upstream |
Needs triage
|
|
| mantic |
Released
(23.2+dfsg-1ubuntu0.1)
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.1 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |