Stay Secure with the Latest Linux Advisories

security advisorycrlf injectionmageia

Mageia: 2019-0258 Critical: Python-urllib3 HTTP Header Issues

It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts (CVE-2018-20060). It was discovered that urllib3 incorrectly stripped certain characters . MGASA-2019-0258 - Updated python-urllib3 packages fix security vulnerability Publication date: 06 Sep 2019 URL: https://advisories.mageia.org/MGASA-2019-0258.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-20060, CVE-2019-11236, CVE-2019-11324 It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts (CVE-2018-20060). It was discovered that urllib3 incorrectly stripped certain charactersfrom requests. A remote attacker could use this issue to perform CRLF injection (CVE-2019-11236). It was discovered that urllib3 incorrectly handled situations where a desired set of CA certificates were specified. This could result in certificates being accepted by the default CA certificates contrary to expectatons (CVE-2019-11324). The python-urllib3 package has been updated to version 1.24.3 to fix these issues and other bugs. The python-requests package has been fixed to work with the updated python-urllib3 References: - https://bugs.mageia.org/show_bug.cgi?id=23880 - https://ubuntu.com/security/notices/USN-3990-1 - https://www.cve.org/CVERecord?id=CVE-2018-20060 - https://www.cve.org/CVERecord?id=CVE-2019-11236 - https://www.cve.org/CVERecord?id=CVE-2019-11324 SRPMS: - 6/core/python-requests-2.11.1-2.2.mga6 - 6/core/python-urllib3-1.24.3-1.mga6 . Recent updates to the python-urllib3 library address critical security vulnerabilities that could lead to unauthorized access and code injection risks.. python-urllib3, security update, authorization headers, cross-origin. . Severity: Critical. LinuxSecurity.com Team

Sep 06, 2019 •Critical Mageia