SB2019091504 - OpenSUSE Linux update for python-urllib3

Security Bulletin ID SB2019091504

Severity

Medium

Patch available

YES

Number of vulnerabilities 3

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) CRLF injection (CVE-ID: CVE-2019-11236)

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient filtration of user-supplied data passed via HTTP request parameters to urllib3 library. A remote attacker can pass specially crafted data that contains CRLF sequences and perform a spoofing attack.

2) Improper Certificate Validation (CVE-ID: CVE-2019-11324)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the urllib3 library for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates. A remote attacker can cause the certificates to be considered trusted contrary to expectations. This is related to use of the "ssl_context", "ca_certs" or "ca_certs_dir" argument.

3) CRLF injection (CVE-ID: CVE-2019-9740)

The vulnerability allows a remote attacker to perform CRLF injection attacks.

The vulnerability exists within urllib2 implementation for Python 2.x and urllib3 implementation for Python 3.x when processing the path component of a URL after the "?" character within the urllib.request.urlopen() call. A remote attacker with ability to control URL, passed to the application, can use CRLF sequences to split the HTTP request and inject arbitrary HTTP headers into request, made by the application.

Remediation

Install update from vendor's website.

References

https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html