RSS   Vulnerabilities for 'Urllib3'   RSS

2019-04-15
 
CVE-2019-11236

CWE-93
 

 
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

 
2018-12-11
 
CVE-2018-20060

CWE-255
 

 
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

 
2017-01-11
 
CVE-2016-9015

 

 
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

 

 >>> Vendor: Python 21 Products
Python
Virtualenv
Beaker
Keyring
Setuptools
RPLY
Pyxdg
Pillow
Requests
PIP
Tgcaptcha2
Urllib3
Python priority library
Hpack
Hyper
Openpyxl
Tablib
Simplejson
Pykerberos
Pypiserver
Python-gnupg


Copyright 2019, cxsecurity.com

 

Back to Top