Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 506
Alerts This Week
Warning Icon 1 506

Fedora 21: FEDORA-2015-9664 Critical: python-urllib3 PyOpenSSL Injection

fedora
Calendar Grey June 18, 2015
Scroller Fedora
The new python-urllib3 update in Fedora 21 resolves multiple security vulnerabilities, notably a pyOpenSSL injection threat.
Inject pyOpenSSL

Summary

Python HTTP module with connection pooling and file POST abilities.

Update Information:

Inject pyOpenSSL. https://urllib3.readthedocs.io/en/latest/advanced-usage.html https://urllib3.readthedocs.io/en/latest/advanced-usage.html

Topics%20covered

Topics Covered

security advisory update critical Fedora injection python-urllib3 pyOpenSSL

Change Log

* Mon Jun 8 2015 Ralph Bean - 1.10.4-3.20150503gita91975b - Apply pyopenssl injection for an outdated cpython as per upstream advice https://urllib3.readthedocs.io/en/latest/advanced-usage.html https://urllib3.readthedocs.io/en/latest/advanced-usage.html * Tue May 19 2015 Ralph Bean - 1.10.4-2.20150503gita91975b - Specify symlinks for six.py{c,o}, fixing rhbz #1222142. * Sun May 3 2015 Ralph Bean - 1.10.4-1.20150503gita91975b - Latest release for python-requests-2.7.0 * Wed Apr 29 2015 Ralph Bean - 1.10.3-2.20150429git585983a - Grab a git snapshot to get around this chunked encoding failure. * Wed Apr 22 2015 Ralph Bean - 1.10.3-1 - new version * Thu Feb 26 2015 Ralph Bean - 1.10.2-1 - new version * Wed Feb 18 2015 Ralph Bean - 1.10.1-1 - new version * Wed Feb 18 2015 Ralph Bean - 1.10.1-1 - new version * Mon Jan 5 2015 Ralph Bean - 1.10-2 - Copy in a shim for ssl_match_hostname on python3. * Sun Dec 14 2014 Ralph Bean - 1.10-1 - Latest upstream 1.10, for python-requests-2.5.0. - Re-do unbundling without patch, with symlinks. - Modernize python2 macros. - Remove the with_dummyserver tests which fail only sometimes. * Wed Nov 5 2014 Ralph Bean - 1.9.1-1 - Latest upstream, 1.9.1 for latest python-requests.

References


[ 1 ] Bug #1222024 - InsecurePlatformWarning: A true SSLContext object is not available https://bugzilla.redhat.com/show_bug.cgi?id=1222024 [ 2 ] Bug #1202077 - python-requests-2.6.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1202077

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update python-urllib3' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: python-urllib3
Product: Fedora 21
Version: 1.10.4
Release: 3.20150503gita91975b.fc21
URL: https://urllib3.readthedocs.io/en/stable/
Summary: Python HTTP library with thread-safe connection pooling and file post

Topics%20covered

Topics Covered

security advisory update critical Fedora injection python-urllib3 pyOpenSSL

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.