Bug 57983 - python-urllib3: Multiple issues (5.0)
Summary: python-urllib3: Multiple issues (5.0)
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Security updates
Version: UCS 5.0
Hardware: All Linux
: P3 normal
Target Milestone: UCS 5.0-9-errata
Assignee: Quality Assurance
QA Contact: Dirk Wiesenthal
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-02-24 10:57 CET by Quality Assurance
Modified: 2025-02-26 14:47 CET (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score: 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2025-02-24 10:57:41 CET 
New Debian python-urllib3 1.24.1-1+deb10u3 fixes:
This update addresses the following issue:
1.24.1-1+deb10u3 (Thu, 20 Feb 2025 13:18:31 +0100)
* Non-maintainer upload by the ELTS Team.
* Fix CVE-2024-37891: Proxy-Authorization request header isn't stripped  during cross-origin redirects.
Comment 1 Quality Assurance univentionstaff 2025-02-24 11:00:12 CET 
--- mirror/ftp/pool/main/p/python-urllib3/python-urllib3_1.24.1-1+deb10u2.dsc
+++ apt/ucs_5.0-0-errata5.0-9/source/python-urllib3_1.24.1-1+deb10u3.dsc
@@ -1,3 +1,9 @@
+1.24.1-1+deb10u3 [Thu, 20 Feb 2025 13:18:31 +0100] Guilhem Moulin <guilhem@debian.org>:
+
+  * Non-maintainer upload by the ELTS Team.
+  * Fix CVE-2024-37891: Proxy-Authorization request header isn't stripped
+    during cross-origin redirects. (Closes: #1074149)
+
 1.24.1-1+deb10u2 [Wed, 08 Nov 2023 11:02:05 +0000] Sean Whitton <spwhitton@spwhitton.name>:
 
   [ Sean Whitton ]

<http://piuparts.knut.univention.de/5.0-9/#6066590953850139703>
Comment 2 Dirk Wiesenthal univentionstaff 2025-02-26 10:40:04 CET 
OK: piuparts
OK: automated tests
Comment 3 Dirk Wiesenthal univentionstaff 2025-02-26 14:47:19 CET 
<https://errata.software-univention.de/#/?erratum=5.0x1219>