python-urllib3: CVE-2023-45803

Debian Bug report logs - #1054226
python-urllib3: CVE-2023-45803

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: python-urllib3: CVE-2023-45803

Date: Thu, 19 Oct 2023 15:57:34 +0200

Source: python-urllib3
Version: 1.26.17-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for python-urllib3.

CVE-2023-45803[0]:
| urllib3 is a user-friendly HTTP client library for Python. urllib3
| previously wouldn't remove the HTTP request body when an HTTP
| redirect response using status 301, 302, or 303 after the request
| had its method changed from one that could accept a request body
| (like `POST`) to `GET` as is required by HTTP RFCs. Although this
| behavior is not specified in the section for redirects, it can be
| inferred by piecing together information from different sections and
| we have observed the behavior in other major HTTP client
| implementations like curl and web browsers. Because the
| vulnerability requires a previously trusted service to become
| compromised in order to have an impact on confidentiality we believe
| the exploitability of this vulnerability is low. Additionally, many
| users aren't putting sensitive data in HTTP request bodies, if this
| is the case then this vulnerability isn't exploitable. Both of the
| following conditions must be true to be affected by this
| vulnerability: 1. Using urllib3 and submitting sensitive information
| in the HTTP request body (such as form data or JSON) and 2. The
| origin service is compromised and starts redirecting using 301, 302,
| or 303 to a malicious peer or the redirected-to service becomes
| compromised. This issue has been addressed in versions 1.26.18 and
| 2.0.7 and users are advised to update to resolve this issue. Users
| unable to update should disable redirects for services that aren't
| expecting to respond with redirects with `redirects=False` and
| disable automatic redirects with `redirects=False` and handle 301,
| 302, and 303 redirects manually by stripping the HTTP request body.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-45803
    https://www.cve.org/CVERecord?id=CVE-2023-45803
[1] https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4
[2] https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36 

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.