CVE-2023-43804

EUVD-2023-0252

04.10.2023, 17:15

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	HIGH	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
GitHub_M	CNA	5.9 MEDIUM	NETWORK	HIGH	HIGH	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 74%

Affected Products (NVD)

Vendor	Product	Version
python	urllib3	𝑥 < 1.26.17
python	urllib3	2.0.0 ≤ 𝑥 < 2.0.6
debian	debian_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

python-urllib3

bookworm	no-dsa
bullseye	vulnerable
bullseye (security)	1.26.5-1~exp1+deb11u1 fixed
sid	2.2.3-4 fixed
trixie	2.2.3-4 fixed

Ubuntu Releases

Ubuntu Product

Codename

python-pip

bionic	Fixed 9.0.1-2.3~ubuntu1.18.04.8+esm2 released
focal	Fixed 20.0.2-5ubuntu1.10 released
jammy	Fixed 22.0.2+dfsg-1ubuntu0.4 released
lunar	Fixed 23.0.1+dfsg-1ubuntu0.2 released
mantic	Fixed 23.2+dfsg-1ubuntu0.1 released
noble	needs-triage
oracular	needs-triage
trusty	ignored
xenial	Fixed 8.1.1-2ubuntu0.6+esm6 released

python-urllib3

bionic	Fixed 1.22-1ubuntu0.18.04.2+esm1 released
focal	Fixed 1.25.8-2ubuntu0.3 released
jammy	Fixed 1.26.5-1~exp1ubuntu0.1 released
lunar	Fixed 1.26.12-1ubuntu0.1 released
mantic	Fixed 1.26.16-1ubuntu0.1 released
noble	not-affected
oracular	not-affected
trusty	ignored
xenial	Fixed 1.13.1-2ubuntu0.16.04.4+esm1 released