SB2024013075 - Red Hat Enterprise Linux 8.8 Extended Update Support update for python-urllib3 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024013075

SB2024013075 - Red Hat Enterprise Linux 8.8 Extended Update Support update for python-urllib3

Published: January 30, 2024 Updated: April 19, 2024

Security Bulletin ID SB2024013075
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2023-43804)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to urllib does not strip the "Cookie" HTTP header during cross-origin HTTP redirects. A remote attacker can gain unauthorized access to sensitive information.


2) Information disclosure (CVE-ID: CVE-2023-45803)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to urllib3 does not remove the HTTP request body when redirecting HTTP response using status codes 301, 302, or 303, after the request had its method changed from one that could accept a request body (e.g. from POST to GET). A remote attacker can gain access to potentially sensitive information.


Remediation

Install update from vendor's website.

References