CVE-2018-20060

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

The following packages have been upgraded to a later upstream version: python2 (2.7.17). (BZ#1759944)

Security Fix(es):

• python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)

• python: Cookie domain check returns incorrect results (CVE-2018-20852)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

• python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

• python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

The following packages have been upgraded to a later upstream version: python2 (2.7.17). (BZ#1759944)

Security Fix(es):

• python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)

• python: Cookie domain check returns incorrect results (CVE-2018-20852)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

• python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

• python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts (CVE-2018-20060).

It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection (CVE-2019-11236).

It was discovered that urllib3 incorrectly handled situations where a desired set of CA certificates were specified. This could result in certificates being accepted by the default CA certificates contrary to expectatons (CVE-2019-11324).

The python-urllib3 package has been updated to version 1.24.3 to fix these issues and other bugs. The python-requests package has been fixed to work with the updated python-urllib3

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the python36-kubernetes-12.0.1-1.8 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-urllib3-1.26.6-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-urllib3_1-1.26.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-urllib3-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-kubernetes-28.1.0-4.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-kubernetes-35.0.0-2.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-urllib3-2.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-urllib3_1-1.26.20-7.2 package on the GA media of openSUSE Tumbleweed.

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Root has patched CVE-2018-20060 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11324: Fixed invalid CA certificat verification (bsc#1132900).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

This update for python-urllib3 fixes the following issues:

Security issues fixed:

• CVE-2019-9740: Fixed CRLF injection issue (bsc#1129071).
• CVE-2019-11236: Fixed CRLF injection via request parameter (bsc#1132663).
• CVE-2018-20060: Remove Authorization header when redirecting cross-host (bsc#1119376).

It was discovered that urllib3 incorrectly removed Authorization HTTP headers when handled cross-origin redirects. This could result in credentials being sent to unintended hosts. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20060)

It was discovered that urllib3 incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. (CVE-2019-11236)

It was discovered that urllib3 incorrectly handled situations where a desired set of CA certificates were specified. This could result in certificates being accepted by the default CA certificates contrary to expectations. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-11324)