Most recent entries from all

ALSA-2023:7753 — Moderate: fence-agents security update

Affected: AlmaLinux:9: fence-agents-aliyun, AlmaLinux:9: fence-agents-all, AlmaLinux:9: fence-agents-amt-ws, AlmaLinux:9: fence-agents-apc, AlmaLinux:9: fence-agents-apc-snmp, AlmaLinux:9: fence-agents-aws, AlmaLinux:9: fence-agents-azure-arm, AlmaLinux:9: fence-agents-bladecenter, AlmaLinux:9: fence-agents-brocade, AlmaLinux:9: fence-agents-cisco-mds and 45 more

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

* python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920) * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-08730

BELL-CVE-2023-43804

Affected: Alpaquita:23: py3-urllib3, Alpaquita:stream: py3-urllib3

BREW-airshare-CVE-2023-43804 — `Cookie` HTTP header isn't stripped on cross-origin redirects

Affected: Homebrew: airshare

urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.

Users **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.

## Affected usages

We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:

* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6) * Using the `Cookie` header on requests, which is mostly typical for impersonating a browser. * Not disabling HTTP redirects * Either not using HTTPS or for the origin server to redirect to a malicious origin.

## Remediation

* Upgrading to at least urllib3 v1.26.17 or v2.0.6 * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Cookie` header.

certfr-2023-avi-0956 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Elles permettent…

certfr-2023-avi-0956

Withdrawn: CLEANSTART-2026-BV53158 — Security fixes in py3-urllib3 1.26.17-r0

Withdrawn by the publisher.

Affected: CleanStart: py3-urllib3

Package py3-urllib3 version 1.26.17-r0 fixes 1 vulnerabilities: CVE-2023-43804

EUVD-2026-258470

fkie_cve-2023-43804

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

GHSA-v845-jxx5-vc9f — `Cookie` HTTP header isn't stripped on cross-origin redirects

Affected: PyPI: urllib3

## Affected usages

We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:

## Remediation

* Upgrading to at least urllib3 v1.26.17 or v2.0.6 * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Cookie` header.

gsd-2023-43804

msrc_CVE-2023-43804 — `Cookie` HTTP header isn't stripped on cross-origin redirects

msrc_CVE-2023-43804

OESA-2023-1707 — python-urllib3 security update

Affected: openEuler:20.03-LTS-SP1: python-urllib3, openEuler:20.03-LTS-SP3: python-urllib3, openEuler:22.03-LTS: python-urllib3, openEuler:22.03-LTS-SP1: python-urllib3, openEuler:22.03-LTS-SP2: python-urllib3

Sanity-friendly HTTP client for Python Security Fix(es): urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.(CVE-2023-43804)

openSUSE-SU-2024:13301-1 — python310-urllib3-2.0.6-1.1 on GA media

python310-urllib3-2.0.6-1.1 on GA media

PYSEC-2023-192

Affected: PyPI: urllib3

RHBA-2023:6852 — Red Hat Bug Fix Advisory: Red Hat Quay v3.9.5 minor release

golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) python-urllib3: Cookie request header isn't stripped during cross-origin redirects

SUSE-SU-2023:4064-1 — Security update for python-urllib3

Security update for python-urllib3

UBUNTU-CVE-2023-43804

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: python-pip, Ubuntu:20.04:LTS: python-urllib3, Ubuntu:22.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3

WID-SEC-W-2023-2862 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um vertrauliche Informationen offenzulegen oder einen nicht näher spezifizierten Angriff zu starten.