OESA-2023-1707

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1707
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2023-1707.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2023-1707
Upstream
Published
2023-10-13T11:06:03Z
Modified
2025-08-12T05:22:29.723937Z
Summary
python-urllib3 security update
Details

Sanity-friendly HTTP client for Python

Security Fix(es):

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.(CVE-2023-43804)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / python-urllib3

Package

Name
python-urllib3
Purl
pkg:rpm/openEuler/python-urllib3&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.25.9-8.oe1

Ecosystem specific 

{
    "src": [
        "python-urllib3-1.25.9-8.oe1.src.rpm"
    ],
    "noarch": [
        "python3-urllib3-1.25.9-8.oe1.noarch.rpm",
        "python2-urllib3-1.25.9-8.oe1.noarch.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / python-urllib3

Package

Name
python-urllib3
Purl
pkg:rpm/openEuler/python-urllib3&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.25.9-9.oe1

Ecosystem specific 

{
    "src": [
        "python-urllib3-1.25.9-9.oe1.src.rpm"
    ],
    "noarch": [
        "python2-urllib3-1.25.9-9.oe1.noarch.rpm",
        "python3-urllib3-1.25.9-9.oe1.noarch.rpm"
    ]
}

openEuler:22.03-LTS / python-urllib3

Package

Name
python-urllib3
Purl
pkg:rpm/openEuler/python-urllib3&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.26.12-5.oe2203sp2

Ecosystem specific 

{
    "src": [
        "python-urllib3-1.26.7-7.oe2203.src.rpm",
        "python-urllib3-1.26.12-5.oe2203sp1.src.rpm",
        "python-urllib3-1.26.12-5.oe2203sp2.src.rpm"
    ],
    "noarch": [
        "python3-urllib3-1.26.7-7.oe2203.noarch.rpm",
        "python3-urllib3-1.26.12-5.oe2203sp1.noarch.rpm",
        "python3-urllib3-1.26.12-5.oe2203sp2.noarch.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / python-urllib3

Package

Name
python-urllib3
Purl
pkg:rpm/openEuler/python-urllib3&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.26.12-5.oe2203sp1

Ecosystem specific 

{
    "src": [
        "python-urllib3-1.26.12-5.oe2203sp1.src.rpm"
    ],
    "noarch": [
        "python3-urllib3-1.26.12-5.oe2203sp1.noarch.rpm"
    ]
}

openEuler:22.03-LTS-SP2 / python-urllib3

Package

Name
python-urllib3
Purl
pkg:rpm/openEuler/python-urllib3&distro=openEuler-22.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.26.12-5.oe2203sp2

Ecosystem specific 

{
    "src": [
        "python-urllib3-1.26.12-5.oe2203sp2.src.rpm"
    ],
    "noarch": [
        "python3-urllib3-1.26.12-5.oe2203sp2.noarch.rpm"
    ]
}