Search for packages
| purl | pkg:deb/debian/python-urllib3@1.25.6-4?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-6kxp-qa5x-q3bq | The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. |
CVE-2019-11324
GHSA-mh33-7rrq-662w PYSEC-2019-133 |
| VCID-b3e6-k53t-bkgk | In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. |
CVE-2019-11236
GHSA-r64q-w8jr-g9qp PYSEC-2019-132 |
| VCID-squd-j9t3-9khh | urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive). |
CVE-2018-25091
GHSA-gwvm-45gx-3cf8 PYSEC-2023-207 |