CVE-2019-11236

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

Security Fix(es):

• numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

• python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

• python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

• python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

The following packages have been upgraded to a later upstream version: python2 (2.7.17). (BZ#1759944)

Security Fix(es):

• python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)

• python: Cookie domain check returns incorrect results (CVE-2018-20852)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

• python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

• python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

Security Fix(es):

• numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

• python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

• python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

• python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

The following packages have been upgraded to a later upstream version: python2 (2.7.17). (BZ#1759944)

Security Fix(es):

• python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)

• python: Cookie domain check returns incorrect results (CVE-2018-20852)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

• python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

• python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts (CVE-2018-20060).

It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection (CVE-2019-11236).

It was discovered that urllib3 incorrectly handled situations where a desired set of CA certificates were specified. This could result in certificates being accepted by the default CA certificates contrary to expectatons (CVE-2019-11324).

The python-urllib3 package has been updated to version 1.24.3 to fix these issues and other bugs. The python-requests package has been fixed to work with the updated python-urllib3

It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection (CVE-2019-11236).

Updated python-pip packages fix security vulnerabilities:

The python-pip package bundles a copy of python-urllib3, which was affected by security issues. The bundled copy was updated to fix these issues (CVE-2019-11324, CVE-2019-11236).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Root has patched CVE-2019-11236 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar fixes the following issues:

• Update to version 9.0+git.1566374020.301191f:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 9.0+git.1563375514.31fa9a7:

  • Ensure ardana-update-pkgs works for dist-upgrade (SOC-9857)

• Update to version 9.0+git.1563192450.30e8f16:

  • Ensure Cloud8/SLE-12-SP3 repps still served (SOC-9840)

• Update to version 9.0+git.1566251498.be02ca4:

  • adds ipv6 format to http/https urls (SOC-10063)

• Update to version 9.0+git.1565678764.c3a9b9f:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1562898832.1731f25:

  • FIX broken symlink for policy.yaml.j2. (SOC-0000)

• Update to version 9.0+git.1559333871.40508f7:

  • Allow system to bind to non local ipv6 addresses (SOC-9330)

• Update to version 9.0+git.1566336494.93967dd:

  • Using python netaddr for ipv6 address comparison (SOC-9940)

• Update to version 9.0+git.1564409964.b7e4fc3:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 9.0+git.1562182567.aef23e0:

  • Format curl commands for ipv6 (SOC-9369)

• Update to version 9.0+git.1565680593.df7a432:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1566213657.69862ab:

  • Add missing service plugin for l2gw (SOC-5837)

• Update to version 9.0+git.1563904379.31ff1e9:

  • Add the NSX-T L2-Gateway Service definition (SOC-5837)

• Switch to new Gerrit Server

• Update to version 9.0+git.1566375806.f0b2333:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 9.0+git.1565720518.c7fdca2:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1564491141.602fdf9:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 9.0+git.1565721273.f44b8d7:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565891518.2a545a1:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565655129.ab3a58c:

  • Removed None condition from rule (SOC-10003)

• Update to version 9.0+git.1564609155.033a963:

  • Updated heat_policy.json permission to be 664 (SOC-9872)

• Update to version 9.0+git.1562848565.91e75b2:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 9.0+git.1566255088.3443670:

  • Add server state column (SOC-9957)

• Update to version 9.0+git.1565218199.868c5d1:

  • Add ipv6 support (SOC-9677) (#357)

• Update to version 9.0+git.1563912815.7090c20:

  • Only show ses config upload option when ses is not configured (SOC-8555)…

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20060)

It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. (CVE-2019-11236)

It was discovered that urllib3 incorrectly handled situations where a desired set of CA certificates were specified. This could result in certificates being accepted by the default CA certificates contrary to expectations. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-11324)

USN-3990-1 fixed a vulnerability in urllib3. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. (CVE-2019-11236)