-------------------------------------------------------------------------
Debian LTS Advisory DLA-3610-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
October 08, 2023                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python-urllib3
Version        : 1.24.1-1+deb10u1
CVE ID         : CVE-2019-11236 CVE-2019-11324 CVE-2020-26137 CVE-2023-43804
Debian Bug     : 927172 927412 1053626

Security vulnerabilities were found in python-urllib3, an HTTP library
with thread-safe connection pooling for Python, which could lead to
information disclosure or authorization bypass.

CVE-2019-11236

    Hanno Böck discovered that an attacker controlling the request
    parameter can inject headers by injecting CR/LF chars.  The issue is
    similar to CPython's CVE-2019-9740.

CVE-2019-11324

    Christian Heimes discovered that when verifying HTTPS connections
    upon passing an SSLContext to urllib3, system CA certificates are
    loaded into the SSLContext by default in addition to any
    manually-specified CA certificates.
    This causes TLS handshakes that should fail given only the manually
    specified certs to succeed based on system CA certs.

CVE-2020-26137

    It was discovered that CRLF injection was possible if the attacker
    controls the HTTP request method, as demonstrated by inserting CR
    and LF control characters in the first argument of putrequest().
    The issue is similar to urllib's CVE-2020-26116.

CVE-2023-43804

    It was discovered that the Cookie request header isn't stripped
    during cross-origin redirects.  It is therefore possible for a user
    specifying a Cookie header to unknowingly leak information via HTTP
    redirects to a different origin (unless the user disables redirects
    explicitly).  The issue is similar to CVE-2018-20060, but for Cookie
    request header rather than Authorization.

    Moreover “authorization” request headers were not removed
    redirecting to cross-site.  Per RFC7230 sec. 3.2 header fields are
    to be treated case-insensitively.

For Debian 10 buster, these problems have been fixed in version
1.24.1-1+deb10u1.

We recommend that you upgrade your python-urllib3 packages.

For the detailed security status of python-urllib3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/python-urllib3

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS