[SECURITY] [DLA 3610-1] python-urllib3 security update

Debian LTS Advisory DLA-3610-1 [email protected]
https://www.debian.org/lts/security/ Guilhem Moulin
October 08, 2023 https://wiki.debian.org/LTS

Package : python-urllib3
Version : 1.24.1-1+deb10u1
CVE ID : CVE-2019-11236 CVE-2019-11324 CVE-2020-26137 CVE-2023-43804
Debian Bug : 927172 927412 1053626

Security vulnerabilities were found in python-urllib3, an HTTP library
with thread-safe connection pooling for Python, which could lead to
information disclosure or authorization bypass.

CVE-2019-11236

Hanno Böck discovered that an attacker controlling the request
parameter can inject headers by injecting CR/LF chars.  The issue is
similar to CPython's CVE-2019-9740.

CVE-2019-11324

Christian Heimes discovered that when verifying HTTPS connections
upon passing an SSLContext to urllib3, system CA certificates are
loaded into the SSLContext by default in addition to any
manually-specified CA certificates.
This causes TLS handshakes that should fail given only the manually
specified certs to succeed based on system CA certs.

CVE-2020-26137

It was discovered that CRLF injection was possible if the attacker
controls the HTTP request method, as demonstrated by inserting CR
and LF control characters in the first argument of putrequest().
The issue is similar to urllib's CVE-2020-26116.

CVE-2023-43804

It was discovered that the Cookie request header isn't stripped
during cross-origin redirects.  It is therefore possible for a user
specifying a Cookie header to unknowingly leak information via HTTP
redirects to a different origin (unless the user disables redirects
explicitly).  The issue is similar to CVE-2018-20060, but for Cookie
request header rather than Authorization.

Moreover “authorization” request headers were not removed
redirecting to cross-site.  Per RFC7230 sec. 3.2 header fields are
to be treated case-insensitively.

For Debian 10 buster, these problems have been fixed in version
1.24.1-1+deb10u1.

We recommend that you upgrade your python-urllib3 packages.

For the detailed security status of python-urllib3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-urllib3

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature