CVE-2023-43804
04.10.2023, 17:15
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.Enginsight
| Vendor | Product | Version |
|---|---|---|
| python | urllib3 | 𝑥 < 1.26.17 |
| python | urllib3 | 2.0.0 ≤ 𝑥 < 2.0.6 |
| debian | debian_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| python-pip |
| ||||||||||||||||||
| python-urllib3 |
|
Common Weakness Enumeration
References