PyPI/urllib3 CVE-2023-43804: medium 5.9, EPSS 1.36%
`Cookie` HTTP header isn't stripped on cross-origin redirects
Action: Upgrade urllib3 to 1.26.17 or later.
pip install urllib3==2.0.6pip install urllib3==1.26.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.0.6 | - |
| 0 | 1.26.17 | - |
Fixed versions
| 2.0.6 | 1.26.17 |
Sources
- osv: GHSA-v845-jxx5-vc9f
- https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
- https://nvd.nist.gov/vuln/detail/CVE-2023-43804
- https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb
- https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-192.yaml
- https://github.com/urllib3/urllib3
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ
- https://security.netapp.com/advisory/ntap-20241213-0007
- https://www.vicarius.io/vsociety/posts/cve-2023-43804-urllib3-vulnerability-3
CVE-2023-43804 · published · modified · JSON