CVE-2023-43804 (High) detected in urllib3-1.26.16-py2.py3-none-any.whl #532
Labels
good first issue
Good for newcomers
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
OSCI-2023
CVE-2023-43804 - High Severity Vulnerability
Vulnerable Library - urllib3-1.26.16-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/c5/05/c214b32d21c0b465506f95c4f28ccbcba15022e000b043b72b3df7728471/urllib3-1.26.16-py2.py3-none-any.whl
Dependency Hierarchy:
Found in HEAD commit: 84ac172ddc54b3e6c975d36221d16ec3e78a2fe9
Found in base branch: main
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the
Cookie
HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify aCookie
header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.Publish Date: 2023-10-04
URL: CVE-2023-43804
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-43804
Release Date: 2023-10-04
Fix Resolution: 1.26.17
The text was updated successfully, but these errors were encountered: