Debian Security Advisory
DLA-3649-1 python-urllib3 -- LTS security update
- Date Reported:
- 08 Nov 2023
- Affected Packages:
- python-urllib3
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 1054226.
In Mitre's CVE dictionary: CVE-2023-43803. - More information:
-
It was discovered that python-urllib3, a user-friendly HTTP client library for Python, did not remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body, like POST, to GET, as required by the HTTP RFCs. This could lead to information disclosure.
For Debian 10 buster, these problems have been fixed in version 1.24.1-1+deb10u2.
We recommend that you upgrade your python-urllib3 packages.
For the detailed security status of python-urllib3 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/python-urllib3
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS