CVE-2023-43804

Description

urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python-urllib3	25.10 questing	Not affected
	25.04 plucky	Not affected
	24.10 oracular	Not affected
	24.04 LTS noble	Not affected
	23.10 mantic	Fixed 1.26.16-1ubuntu0.1
	23.04 lunar	Fixed 1.26.12-1ubuntu0.1
	22.04 LTS jammy	Fixed 1.26.5-1~exp1ubuntu0.1
	20.04 LTS focal	Fixed 1.25.8-2ubuntu0.3
	18.04 LTS bionic	Fixed 1.22-1ubuntu0.18.04.2+esm1
	16.04 LTS xenial	Fixed 1.13.1-2ubuntu0.16.04.4+esm1
	14.04 LTS trusty	Vulnerable
python-pip	25.10 questing	Not affected
	25.04 plucky	Not affected
	24.10 oracular	Ignored end of life, was needs-triage
	24.04 LTS noble	Not affected
	23.10 mantic	Fixed 23.2+dfsg-1ubuntu0.1
	23.04 lunar	Fixed 23.0.1+dfsg-1ubuntu0.2
	22.04 LTS jammy	Fixed 22.0.2+dfsg-1ubuntu0.4
	20.04 LTS focal	Fixed 20.0.2-5ubuntu1.10
	18.04 LTS bionic	Fixed 9.0.1-2.3~ubuntu1.18.04.8+esm2
	16.04 LTS xenial	Fixed 8.1.1-2ubuntu0.6+esm6
	14.04 LTS trusty	Vulnerable

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

mdeslaur

On focal and earlier, the python-pip package bundles python-urllib3 binaries when built. After updating python-urllib3, a no-change rebuild of python-pip is required. On jammy and later, python-urllib3 is bundled in the python-pip package and needs to be patched.

ej7367

For python-urllib3 in trusty, the fix for CVE-2018-20060 needs to be backported first, as the patch for this CVE builds on features implemented by that fix.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
python-urllib3	Upstream: 644124e Upstream: 0122035
python-pip	Upstream: 2333ef3

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	High
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

CVE-2023-43804

Cvss 3 Severity Score