CVE-2023-43804 (High) detected in urllib3-1.26.2-py2.py3-none-any.whl
Opened this issue · 0 comments
CVE-2023-43804 - High Severity Vulnerability
Vulnerable Library - urllib3-1.26.2-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/f5/71/45d36a8df68f3ebb098d6861b2c017f3d094538c0fb98fa61d4dc43e69b9/urllib3-1.26.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- streamlit-0.55.2-py2.py3-none-any.whl (Root Library)
- boto3-1.16.23-py2.py3-none-any.whl
- botocore-1.19.23-py2.py3-none-any.whl
- ❌ urllib3-1.26.2-py2.py3-none-any.whl (Vulnerable Library)
- botocore-1.19.23-py2.py3-none-any.whl
- boto3-1.16.23-py2.py3-none-any.whl
Found in base branch: main
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie
HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie
header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Publish Date: 2023-10-04
URL: CVE-2023-43804
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-43804
Release Date: 2023-10-04
Fix Resolution (urllib3): 1.26.17
Direct dependency fix Resolution (streamlit): 0.56.0
Step up your Open Source Security Game with Mend here