PyPI/urllib3 CVE-2023-45803: medium 4.2, EPSS 0.59%
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had i
Action: Upgrade urllib3 to 1.26.18 or later.
pip install urllib3==2.0.7pip install urllib3==1.26.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.26.18 | - |
| 2.0.0 | 2.0.7 | - |
Fixed versions
| 2.0.7 | 1.26.18 |
Sources
- osv: PYSEC-2023-212
- https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4
- https://www.rfc-editor.org/rfc/rfc9110.html#name-get
- https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/
CVE-2023-45803 · published · modified · JSON