------------------------------------------------------------------------- Debian LTS Advisory DLA-3649-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Sean Whitton November 08, 2023 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : python-urllib3 Version : 1.24.1-1+deb10u2 CVE ID : CVE-2023-43803 Debian Bug : 1054226 It was discovered that python-urllib3, a user-friendly HTTP client library for Python, did not remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body, like POST, to GET, as required by the HTTP RFCs. This could lead to information disclosure. For Debian 10 buster, these problems have been fixed in version 1.24.1-1+deb10u2. We recommend that you upgrade your python-urllib3 packages. For the detailed security status of python-urllib3 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/python-urllib3 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature