USN-7084-1: urllib3 vulnerability

Releases

• Ubuntu 24.10
• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• python-urllib3 - HTTP library with thread-safe connection pooling

Details

It was discovered that urllib3 didn't strip HTTP Proxy-Authorization header
on cross-origin redirects. A remote attacker could possibly use this issue
to obtain sensitive information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• python3-urllib3 - 2.0.7-2ubuntu0.1

Ubuntu 24.04

• python3-urllib3 - 2.0.7-1ubuntu0.1

Ubuntu 22.04

• python3-urllib3 - 1.26.5-1~exp1ubuntu0.2

Ubuntu 20.04

• python3-urllib3 - 1.25.8-2ubuntu0.4

Ubuntu 18.04

• python-urllib3 - 1.22-1ubuntu0.18.04.2+esm2
  Available with Ubuntu Pro
• python3-urllib3 - 1.22-1ubuntu0.18.04.2+esm2
  Available with Ubuntu Pro

Ubuntu 16.04

• python-urllib3 - 1.13.1-2ubuntu0.16.04.4+esm2
  Available with Ubuntu Pro
• python3-urllib3 - 1.13.1-2ubuntu0.16.04.4+esm2
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-37891

Related notices

• USN-7084-2: python-pip, python-pip-whl, python3-pip-whl, python3-pip