python310-urllib3-2.1.0-3.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14055 Final 1 1 2024-06-18T21:44:58Z current 2024-06-18T21:44:58Z 2024-06-18T21:44:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z python310-urllib3-2.1.0-3.1 on GA media These are all security issues fixed in the python310-urllib3-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14055 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2016-9015/ SUSE CVE CVE-2016-9015 page https://www.suse.com/security/cve/CVE-2018-20060/ SUSE CVE CVE-2018-20060 page https://www.suse.com/security/cve/CVE-2019-11324/ SUSE CVE CVE-2019-11324 page https://www.suse.com/security/cve/CVE-2019-9740/ SUSE CVE CVE-2019-9740 page https://www.suse.com/security/cve/CVE-2021-33503/ SUSE CVE CVE-2021-33503 page https://www.suse.com/security/cve/CVE-2024-37891/ SUSE CVE CVE-2024-37891 page openSUSE Tumbleweed python310-urllib3-2.1.0-3.1 python311-urllib3-2.1.0-3.1 python312-urllib3-2.1.0-3.1 python310-urllib3-2.1.0-3.1 as a component of openSUSE Tumbleweed python311-urllib3-2.1.0-3.1 as a component of openSUSE Tumbleweed python312-urllib3-2.1.0-3.1 as a component of openSUSE Tumbleweed Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low. CVE-2016-9015 openSUSE Tumbleweed:python310-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python311-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python312-urllib3-2.1.0-3.1 moderate 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9015.html CVE-2016-9015 https://bugzilla.suse.com/1023502 SUSE Bug 1023502 https://bugzilla.suse.com/1024540 SUSE Bug 1024540 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext. CVE-2018-20060 openSUSE Tumbleweed:python310-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python311-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python312-urllib3-2.1.0-3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20060.html CVE-2018-20060 https://bugzilla.suse.com/1119376 SUSE Bug 1119376 https://bugzilla.suse.com/1216275 SUSE Bug 1216275 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. CVE-2019-11324 openSUSE Tumbleweed:python310-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python311-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python312-urllib3-2.1.0-3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-11324.html CVE-2019-11324 https://bugzilla.suse.com/1132900 SUSE Bug 1132900 An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. CVE-2019-9740 openSUSE Tumbleweed:python310-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python311-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python312-urllib3-2.1.0-3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9740.html CVE-2019-9740 https://bugzilla.suse.com/1129071 SUSE Bug 1129071 https://bugzilla.suse.com/1130840 SUSE Bug 1130840 https://bugzilla.suse.com/1132663 SUSE Bug 1132663 An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. CVE-2021-33503 openSUSE Tumbleweed:python310-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python311-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python312-urllib3-2.1.0-3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-33503.html CVE-2021-33503 https://bugzilla.suse.com/1187045 SUSE Bug 1187045 urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations. CVE-2024-37891 openSUSE Tumbleweed:python310-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python311-urllib3-2.1.0-3.1 openSUSE Tumbleweed:python312-urllib3-2.1.0-3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-37891.html CVE-2024-37891 https://bugzilla.suse.com/1226469 SUSE Bug 1226469