SB2026102955 - openEuler 22.03 LTS SP4 update for python-urllib3

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Certificate Validation (CVE-ID: CVE-2026-97687)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and modify forwarded requests and responses.

The vulnerability exists due to improper certificate validation in the HTTPS proxy TLS configuration when handling TLS connections to HTTPS proxies. A remote attacker can impersonate an HTTPS proxy using a certificate accepted under the effective proxy TLS policy to disclose sensitive information and modify forwarded requests and responses.

Exploitation requires intercepting the connection to an HTTPS proxy.

2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-97689)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the HTTPResponse.stream() and read_chunked() methods when processing a chunked-transfer-encoded response with an unterminated chunk-size field. A remote attacker can send a crafted chunked response containing a long run of bytes without a newline to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4625