CVE-2021-33503

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP...

Security Bulletin: Vulnerabilities in Python, Tornado, and Urllib3 affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore

Summary IBM Spectrum Protect Plus Microsoft® File Systems backup and restore may be affected by vulnerabilities in Python, Tornado. and Urllib3 such as server-side request forgery, HTTP response splitting, buffer overflow, and man-in-the-middle attacks. Vulnerability Details CVEID: CVE-2021-29921...

Security Bulletin: Vulnerabilities in Redis, MinIO, Golang, and Urllib3 affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift

Summary IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift may be affected by vulnerabilities in Redis, MinIO, Golang, and Urllib3 such as bypass of security restrictions, denial of service, and man-in-the-middle attacks. Vulnerability Details CVEID: CVE-2021-2136...

SUSE-SU-2021:2195-1 Security update for python-urllib3, python-requests

This update for python-urllib3 and python-requests fixes the following issues: Security fix: - Improve performance of sub-authority splitting in URL. bsc1187045, CVE-2021-33503 Non-security changes: - Update python-urllib3 to version 1.25.10 to stay compatible with changes needed in the Server an...

SUSE-RU-2021:2194-1 Recommended update for the Azure and AWS SDKs

This update for the SLE Public Cloud module provides the following fixes: Azure SDK update: This update for the Azure SDK and CLI adds support for the AHB Azure Hybrid Benefit. bsc1176784, jscECO-3105 AWS SDK update: This update for the AWS SDK updates python-boto3 to version 1.17.9 and aws-cli t...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python urllib3

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Python urllib3. Vulnerability Details CVEID: CVE-2021-28363 DESCRIPTION: urllib3 for python is vulnerable to a man-in-the-middle attack, caused by improper certificate validation in some cases involving HTTPS...

Amazon Linux 2 : python-urllib3 (ALAS-2021-1668)

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1668 advisory. A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP reques...

Medium: python-pip

Issue Overview: A flaw was found in python-urllib3. SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates...

Medium: python-urllib3

Issue Overview: A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to...

SUSE SLED15 / SLES15 Security Update : python-urllib3 (SUSE-SU-2021:2012-1)

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:2012-1 advisory. - CVE-2021-33503: Fixed a denial of service when the URL contained many @ characters in the authority component bsc1187045 Tenable has extracte...

SUSE: Security Advisory (SUSE-SU-2021:2012-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for mingw-python-urllib3 (FEDORA-2021-b14975e43d)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: mingw-python-urllib3-1.25.10-3.fc34

MinGW Windows Python urllib3...

CRLF injection in urllib3

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

GHSA-WQVQ-5M8C-6G24 CRLF injection in urllib3

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

SUSE-SU-2021:2012-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2021-33503: Fixed a denial of service when the URL contained many @ characters in the authority component bsc1187045...

Debian: Security Advisory (DLA-2686-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2686-1] python-urllib3 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2686-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA June 15, 2021 https://wiki.debian.org/LTS -...

DLA-2686-1 python-urllib3 - security update

Bulletin has no description...

urllib3 资源管理错误漏洞

urllib3 is a Python HTTP library. It features thread-safe connection pooling, file publishing support, and more. Urllib3 suffers from a Resource Management Error vulnerability that originates from adding the @ parameter to the URL of the authentication module, which can be exploited by an attacke...