USN-6473-2: pip vulnerabilities
15 November 2023
Several security issues were fixed in pip.
Releases
Packages
- python-pip - Python package installer
Details
USN-6473-1 fixed vulnerabilities in urllib3. This update provides the
corresponding updates for the urllib3 module bundled into pip.
Original advisory details:
It was discovered that urllib3 didn't strip HTTP Authorization header
on cross-origin redirects. A remote attacker could possibly use this
issue to obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-25091)
It was discovered that urllib3 didn't strip HTTP Cookie header on
cross-origin redirects. A remote attacker could possibly use this
issue to obtain sensitive information. (CVE-2023-43804)
It was discovered that urllib3 didn't strip HTTP body on status code
303 redirects under certain circumstances. A remote attacker could
possibly use this issue to obtain sensitive information. (CVE-2023-45803)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 23.10
Ubuntu 23.04
Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04
-
python-pip
-
9.0.1-2.3~ubuntu1.18.04.8+esm2
Available with Ubuntu Pro
-
python-pip-whl
-
9.0.1-2.3~ubuntu1.18.04.8+esm2
Available with Ubuntu Pro
-
python3-pip
-
9.0.1-2.3~ubuntu1.18.04.8+esm2
Available with Ubuntu Pro
Ubuntu 16.04
-
python-pip
-
8.1.1-2ubuntu0.6+esm6
Available with Ubuntu Pro
-
python-pip-whl
-
8.1.1-2ubuntu0.6+esm6
Available with Ubuntu Pro
-
python3-pip
-
8.1.1-2ubuntu0.6+esm6
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-6473-1: python3-urllib3, python-urllib3