MGASA-2024-0347 - Updated python-urllib3 packages fix security vulnerability

Publication date: 08 Nov 2024
URL: https://advisories.mageia.org/MGASA-2024-0347.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-37891

When using urllib3's proxy support with ProxyManager, the
Proxy-Authorization header is only sent to the configured proxy, as
expected.
However, when sending HTTP requests without using urllib3's proxy
support, it's possible to accidentally configure the Proxy-Authorization
header even though it won't have any effect as the request is not using
a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't
treat the Proxy-Authorization HTTP header as one carrying authentication
material and thus doesn't strip the header on cross-origin redirects.
Because this is a highly unlikely scenario, we believe the severity of
this vulnerability is low for almost all users. Out of an abundance of
caution urllib3 will automatically strip the Proxy-Authorization header
during cross-origin redirects to avoid the small chance that users are
doing this on accident.
Users should use urllib3's proxy support or disable automatic redirects
to achieve safe processing of the Proxy-Authorization header, but we
still decided to strip the header by default in order to further protect
users who aren't using the correct approach.

References:
- https://bugs.mageia.org/show_bug.cgi?id=33716
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37891

SRPMS:
- 9/core/python-urllib3-1.26.20-1.mga9