USN-7084-1: urllib3 vulnerability
29 October 2024
urllib3 could leak sensitive information.
Releases
Packages
- python-urllib3 - HTTP library with thread-safe connection pooling
Details
It was discovered that urllib3 didn't strip HTTP Proxy-Authorization header
on cross-origin redirects. A remote attacker could possibly use this issue
to obtain sensitive information.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 24.10
Ubuntu 24.04
Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04
-
python-urllib3
-
1.22-1ubuntu0.18.04.2+esm2
Available with Ubuntu Pro
-
python3-urllib3
-
1.22-1ubuntu0.18.04.2+esm2
Available with Ubuntu Pro
Ubuntu 16.04
-
python-urllib3
-
1.13.1-2ubuntu0.16.04.4+esm2
Available with Ubuntu Pro
-
python3-urllib3
-
1.13.1-2ubuntu0.16.04.4+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.