Red Hat Security Advisory: python-pip security update
An update for python-pip is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-11324US | high7.5 | — | ||
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in S… | ||||
| CVE-2019-11236US | medium6.1 | — | ||
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. | ||||
| CVE-2018-20060US | critical9.8 | — | ||
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can… | ||||
| CVE-2018-18074US | high7.5 | Exploit | ||
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for rem… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/indexexternal
- https://access.redhat.com/errata/RHSA-2020:1916self
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 1643829external
- 1649153external
- 1700824external
- 1702473external
- Canonical URLself
remediations (24)
- Fixedplatform-python-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedplatform-python-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedplatform-python-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedplatform-python-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython-pip-0:9.0.3-16.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython-pip-0:9.0.3-16.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython-pip-0:9.0.3-16.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython-pip-0:9.0.3-16.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython3-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython3-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython3-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython3-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython3-pip-wheel-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython3-pip-wheel-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython3-pip-wheel-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Fixedpython3-pip-wheel-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2020:1916 - Workaroundplatform-python-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
The urllib3 package is used by elastic-curator, which is deployed in the ose-logging-curator, and used by the optional logging feature in OpenShift Container Platform (OCP). Therefore OCP 3.11 users can mitigate this issue by not deploying and using the Curator logging feature. In OCP 4 urllib3 is also used by several Ansible Play Book images built with the Operator SDK and available for installation in OCP 4 including openshift-enterprise-ansible-operator and ose-metering-ansible-operator. Therefore those operators should not be deployed in order to mitigate this issue in OCP 4.
- Workaroundplatform-python-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Use `retries=urllib3.Retry(redirect=0)` when performing requests if you do not need redirection and handle the redirects manually if you need them.
- Workaroundpython-pip-0:9.0.3-16.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
The urllib3 package is used by elastic-curator, which is deployed in the ose-logging-curator, and used by the optional logging feature in OpenShift Container Platform (OCP). Therefore OCP 3.11 users can mitigate this issue by not deploying and using the Curator logging feature. In OCP 4 urllib3 is also used by several Ansible Play Book images built with the Operator SDK and available for installation in OCP 4 including openshift-enterprise-ansible-operator and ose-metering-ansible-operator. Therefore those operators should not be deployed in order to mitigate this issue in OCP 4.
- Workaroundpython-pip-0:9.0.3-16.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Use `retries=urllib3.Retry(redirect=0)` when performing requests if you do not need redirection and handle the redirects manually if you need them.
- Workaroundpython3-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
The urllib3 package is used by elastic-curator, which is deployed in the ose-logging-curator, and used by the optional logging feature in OpenShift Container Platform (OCP). Therefore OCP 3.11 users can mitigate this issue by not deploying and using the Curator logging feature. In OCP 4 urllib3 is also used by several Ansible Play Book images built with the Operator SDK and available for installation in OCP 4 including openshift-enterprise-ansible-operator and ose-metering-ansible-operator. Therefore those operators should not be deployed in order to mitigate this issue in OCP 4.
- Workaroundpython3-pip-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
Use `retries=urllib3.Retry(redirect=0)` when performing requests if you do not need redirection and handle the redirects manually if you need them.
- Workaroundpython3-pip-wheel-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
The urllib3 package is used by elastic-curator, which is deployed in the ose-logging-curator, and used by the optional logging feature in OpenShift Container Platform (OCP). Therefore OCP 3.11 users can mitigate this issue by not deploying and using the Curator logging feature. In OCP 4 urllib3 is also used by several Ansible Play Book images built with the Operator SDK and available for installation in OCP 4 including openshift-enterprise-ansible-operator and ose-metering-ansible-operator. Therefore those operators should not be deployed in order to mitigate this issue in OCP 4.
- Workaroundpython3-pip-wheel-0:9.0.3-16.el8.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
Use `retries=urllib3.Retry(redirect=0)` when performing requests if you do not need redirection and handle the redirects manually if you need them.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan