Synopsis
Moderate: python-pip security update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for python-pip is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package Index (PyPI). pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python"
Security Fix(es):
- python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)
- python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)
- python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)
- python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
-
Red Hat Enterprise Linux Server 7 x86_64
-
Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
-
Red Hat Enterprise Linux Workstation 7 x86_64
-
Red Hat Enterprise Linux Desktop 7 x86_64
-
Red Hat Enterprise Linux for IBM z Systems 7 s390x
-
Red Hat Enterprise Linux for Power, big endian 7 ppc64
-
Red Hat Enterprise Linux for Scientific Computing 7 x86_64
-
Red Hat Enterprise Linux for Power, little endian 7 ppc64le
-
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
-
Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
-
Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le
Fixes
-
BZ - 1643829
- CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
-
BZ - 1649153
- CVE-2018-20060 python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure
-
BZ - 1700824
- CVE-2019-11236 python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service
-
BZ - 1702473
- CVE-2019-11324 python-urllib3: Certification mishandle when error should be thrown
Note:
More recent versions of these packages may be available.
Click a package name for more details.
Red Hat Enterprise Linux Server 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
x86_64 |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux Server - Extended Life Cycle Support 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
x86_64 |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux Workstation 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
x86_64 |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux Desktop 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
x86_64 |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux for IBM z Systems 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
s390x |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux for Power, big endian 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
ppc64 |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux for Scientific Computing 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
x86_64 |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux for Power, little endian 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
ppc64le |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
s390x |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
ppc64 |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |
Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7
SRPM |
python-pip-9.0.3-7.el7_8.src.rpm
|
SHA-256: 53c79c65ce912cc1e2b9ebbfcd25c66ab1943524d26cc496169b3de3abf5d34c |
ppc64le |
python3-pip-9.0.3-7.el7_8.noarch.rpm
|
SHA-256: 07b00547be6c181d9501d7fe12b37df2ca5fb4d87b6eb5dc67fd439b2f153bad |