Synopsis
Moderate: python-urllib3 security update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for python-urllib3 is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities.
Security Fix(es):
- python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)
- urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
-
Red Hat Enterprise Linux for x86_64 9 x86_64
-
Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
-
Red Hat Enterprise Linux Server - AUS 9.4 x86_64
-
Red Hat Enterprise Linux for IBM z Systems 9 s390x
-
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
-
Red Hat Enterprise Linux for Power, little endian 9 ppc64le
-
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
-
Red Hat Enterprise Linux for ARM 64 9 aarch64
-
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
-
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
-
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
-
Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
-
Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
Fixes
-
BZ - 2242493
- CVE-2023-43804 python-urllib3: Cookie request header isn't stripped during cross-origin redirects
-
BZ - 2246840
- CVE-2023-45803 urllib3: Request body not stripped after redirect from 303 status changes request method to GET
Note:
More recent versions of these packages may be available.
Click a package name for more details.
Red Hat Enterprise Linux for x86_64 9
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
x86_64 |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
x86_64 |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux Server - AUS 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
x86_64 |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for IBM z Systems 9
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
s390x |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
s390x |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for Power, little endian 9
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
ppc64le |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
ppc64le |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for ARM 64 9
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
aarch64 |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
aarch64 |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
ppc64le |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
x86_64 |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
aarch64 |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |
Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4
SRPM |
python-urllib3-1.26.5-3.el9_3.1.src.rpm
|
SHA-256: 4d751dd72e3d7cf1346bf3d9ce7c06328fc78e3694fe794bba551c138f7a3ab2 |
s390x |
python3-urllib3-1.26.5-3.el9_3.1.noarch.rpm
|
SHA-256: 4d836e2dab391c4b036b19e7034db4341756e729519a7747dc156ebd71427a7a |