python36-urllib3-1.26.6-1.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11277 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z python36-urllib3-1.26.6-1.2 on GA media These are all security issues fixed in the python36-urllib3-1.26.6-1.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11277 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:11277 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2016-9015/ SUSE CVE CVE-2016-9015 page https://www.suse.com/security/cve/CVE-2018-20060/ SUSE CVE CVE-2018-20060 page https://www.suse.com/security/cve/CVE-2019-11324/ SUSE CVE CVE-2019-11324 page https://www.suse.com/security/cve/CVE-2019-9740/ SUSE CVE CVE-2019-9740 page https://www.suse.com/security/cve/CVE-2021-33503/ SUSE CVE CVE-2021-33503 page openSUSE Tumbleweed python36-urllib3-1.26.6-1.2 python38-urllib3-1.26.6-1.2 python39-urllib3-1.26.6-1.2 python36-urllib3-1.26.6-1.2 as a component of openSUSE Tumbleweed python38-urllib3-1.26.6-1.2 as a component of openSUSE Tumbleweed python39-urllib3-1.26.6-1.2 as a component of openSUSE Tumbleweed Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low. CVE-2016-9015 openSUSE Tumbleweed:python36-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python38-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python39-urllib3-1.26.6-1.2 low 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9015.html CVE-2016-9015 https://bugzilla.suse.com/1023502 SUSE Bug 1023502 https://bugzilla.suse.com/1024540 SUSE Bug 1024540 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. CVE-2018-20060 openSUSE Tumbleweed:python36-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python38-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python39-urllib3-1.26.6-1.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20060.html CVE-2018-20060 https://bugzilla.suse.com/1119376 SUSE Bug 1119376 https://bugzilla.suse.com/1216275 SUSE Bug 1216275 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. CVE-2019-11324 openSUSE Tumbleweed:python36-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python38-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python39-urllib3-1.26.6-1.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-11324.html CVE-2019-11324 https://bugzilla.suse.com/1132900 SUSE Bug 1132900 An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. CVE-2019-9740 openSUSE Tumbleweed:python36-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python38-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python39-urllib3-1.26.6-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9740.html CVE-2019-9740 https://bugzilla.suse.com/1129071 SUSE Bug 1129071 https://bugzilla.suse.com/1130840 SUSE Bug 1130840 https://bugzilla.suse.com/1132663 SUSE Bug 1132663 An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. CVE-2021-33503 openSUSE Tumbleweed:python36-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python38-urllib3-1.26.6-1.2 openSUSE Tumbleweed:python39-urllib3-1.26.6-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-33503.html CVE-2021-33503 https://bugzilla.suse.com/1187045 SUSE Bug 1187045