USN-7084-2: pip vulnerability
30 October 2024
urllib3 could leak sensitive information.
Releases
Packages
- python-pip - Python package installer
Details
USN-7084-1 fixed vulnerability in urllib3. This update provides the
corresponding update for the urllib3 module bundled into pip.
Original advisory details:
It was discovered that urllib3 didn't strip HTTP Proxy-Authorization
header on cross-origin redirects. A remote attacker could possibly use
this issue to obtain sensitive information.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 24.10
Ubuntu 24.04
Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04
-
python-pip
-
9.0.1-2.3~ubuntu1.18.04.8+esm6
Available with Ubuntu Pro
-
python-pip-whl
-
9.0.1-2.3~ubuntu1.18.04.8+esm6
Available with Ubuntu Pro
-
python3-pip
-
9.0.1-2.3~ubuntu1.18.04.8+esm6
Available with Ubuntu Pro
Ubuntu 16.04
-
python-pip
-
8.1.1-2ubuntu0.6+esm10
Available with Ubuntu Pro
-
python-pip-whl
-
8.1.1-2ubuntu0.6+esm10
Available with Ubuntu Pro
-
python3-pip
-
8.1.1-2ubuntu0.6+esm10
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.