UBUNTU-CVE-2024-37891
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server o
UBUNTU-CVE-2024-37891
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:UBUNTU-CVE-2024-37891
python-pip
Source reference: /affected/0/package/name
- Affected versions
- 1.4.1-2
Source reference:
/affected/0/versions1.5.4-1Source reference:
/affected/0/versions1.5.4-1ubuntu1Source reference:
/affected/0/versions1.5.4-1ubuntu3Source reference:
/affected/0/versions1.5.4-1ubuntu4Source reference:
/affected/0/versions1.5.4-1ubuntu4+esm1Source reference:
/affected/0/versions1.5.4-1ubuntu4+esm2Source reference:
/affected/0/versions1.5.4-1ubuntu4+esm3Source reference:
/affected/0/versions1.5.4-1ubuntu4+esm4Source reference:
/affected/0/versions1.5.4-1ubuntu4+esm5Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
python-urllib3
Source reference: /affected/1/package/name
- Affected versions
- 1.11-1
Source reference:
/affected/1/versions1.12-1Source reference:
/affected/1/versions1.13.1-1Source reference:
/affected/1/versions1.13.1-2Source reference:
/affected/1/versions1.13.1-2ubuntu0.16.04.1Source reference:
/affected/1/versions1.13.1-2ubuntu0.16.04.2Source reference:
/affected/1/versions1.13.1-2ubuntu0.16.04.3Source reference:
/affected/1/versions1.13.1-2ubuntu0.16.04.4Source reference:
/affected/1/versions1.13.1-2ubuntu0.16.04.4+esm1Source reference:
/affected/1/versions - Fixed versions
- 1.13.1-2ubuntu0.16.04.4+esm2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
python-pip
Source reference: /affected/2/package/name
- Affected versions
- 1.5.6-7ubuntu1
Source reference:
/affected/2/versions1.5.6-7ubuntu2Source reference:
/affected/2/versions8.0.2-7Source reference:
/affected/2/versions8.0.3-1Source reference:
/affected/2/versions8.0.3-2Source reference:
/affected/2/versions8.1.0-1Source reference:
/affected/2/versions8.1.0-2Source reference:
/affected/2/versions8.1.1-1Source reference:
/affected/2/versions8.1.1-2Source reference:
/affected/2/versions8.1.1-2ubuntu0.1Source reference:
/affected/2/versions8.1.1-2ubuntu0.2Source reference:
/affected/2/versions8.1.1-2ubuntu0.4Source reference:
/affected/2/versions8.1.1-2ubuntu0.6Source reference:
/affected/2/versions8.1.1-2ubuntu0.6+esm2Source reference:
/affected/2/versions8.1.1-2ubuntu0.6+esm3Source reference:
/affected/2/versions8.1.1-2ubuntu0.6+esm4Source reference:
/affected/2/versions8.1.1-2ubuntu0.6+esm5Source reference:
/affected/2/versions8.1.1-2ubuntu0.6+esm6Source reference:
/affected/2/versions8.1.1-2ubuntu0.6+esm8Source reference:
/affected/2/versions - Fixed versions
- 8.1.1-2ubuntu0.6+esm10
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
python-urllib3
Source reference: /affected/3/package/name
- Affected versions
- 1.21.1-1
Source reference:
/affected/3/versions1.22-1Source reference:
/affected/3/versions1.22-1ubuntu0.18.04.1Source reference:
/affected/3/versions1.22-1ubuntu0.18.04.2Source reference:
/affected/3/versions1.22-1ubuntu0.18.04.2+esm1Source reference:
/affected/3/versions - Fixed versions
- 1.22-1ubuntu0.18.04.2+esm2
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
python-pip
Source reference: /affected/4/package/name
- Affected versions
- 9.0.1-2
Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.1Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.2Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.3Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.4Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.5Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.5+esm2Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.5+esm3Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.6Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.6+esm1Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.7Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.7+esm1Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.8Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.8+esm1Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.8+esm2Source reference:
/affected/4/versions9.0.1-2.3~ubuntu1.18.04.8+esm4Source reference:
/affected/4/versions - Fixed versions
- 9.0.1-2.3~ubuntu1.18.04.8+esm6
Source reference:
/affected/4/ranges - Prerequisites
- Not stated in this record
python-pip
Source reference: /affected/5/package/name
- Affected versions
- 18.1-5
Source reference:
/affected/5/versions18.1-5build1Source reference:
/affected/5/versions18.1-5ubuntu1Source reference:
/affected/5/versions20.0.2-2Source reference:
/affected/5/versions20.0.2-4Source reference:
/affected/5/versions20.0.2-5Source reference:
/affected/5/versions20.0.2-5ubuntu1Source reference:
/affected/5/versions20.0.2-5ubuntu1.1Source reference:
/affected/5/versions20.0.2-5ubuntu1.3Source reference:
/affected/5/versions20.0.2-5ubuntu1.4Source reference:
/affected/5/versions20.0.2-5ubuntu1.5Source reference:
/affected/5/versions20.0.2-5ubuntu1.6Source reference:
/affected/5/versions20.0.2-5ubuntu1.7Source reference:
/affected/5/versions20.0.2-5ubuntu1.8Source reference:
/affected/5/versions20.0.2-5ubuntu1.9Source reference:
/affected/5/versions20.0.2-5ubuntu1.10Source reference:
/affected/5/versions - Fixed versions
- 20.0.2-5ubuntu1.11
Source reference:
/affected/5/ranges - Prerequisites
- Not stated in this record
python-urllib3
Source reference: /affected/6/package/name
- Affected versions
- 1.24.1-1ubuntu1
Source reference:
/affected/6/versions1.24.1-1ubuntu2Source reference:
/affected/6/versions1.25.8-1Source reference:
/affected/6/versions1.25.8-2Source reference:
/affected/6/versions1.25.8-2ubuntu0.1Source reference:
/affected/6/versions1.25.8-2ubuntu0.2Source reference:
/affected/6/versions1.25.8-2ubuntu0.3Source reference:
/affected/6/versions - Fixed versions
- 1.25.8-2ubuntu0.4
Source reference:
/affected/6/ranges - Prerequisites
- Not stated in this record
python-pip
Source reference: /affected/7/package/name
- Affected versions
- 20.3.4-4
Source reference:
/affected/7/versions21.3.1+dfsg-3Source reference:
/affected/7/versions22.0.2+dfsg-1Source reference:
/affected/7/versions22.0.2+dfsg-1ubuntu0.1Source reference:
/affected/7/versions22.0.2+dfsg-1ubuntu0.2Source reference:
/affected/7/versions22.0.2+dfsg-1ubuntu0.3Source reference:
/affected/7/versions22.0.2+dfsg-1ubuntu0.4Source reference:
/affected/7/versions - Fixed versions
- 22.0.2+dfsg-1ubuntu0.5
Source reference:
/affected/7/ranges - Prerequisites
- Not stated in this record
python-urllib3
Source reference: /affected/8/package/name
- Affected versions
- 1.26.5-1~exp1
Source reference:
/affected/8/versions1.26.5-1~exp1ubuntu0.1Source reference:
/affected/8/versions - Fixed versions
- 1.26.5-1~exp1ubuntu0.2
Source reference:
/affected/8/ranges - Prerequisites
- Not stated in this record
python-pip
Source reference: /affected/9/package/name
- Affected versions
- 23.2+dfsg-1
Source reference:
/affected/9/versions23.3+dfsg-1Source reference:
/affected/9/versions24.0+dfsg-1Source reference:
/affected/9/versions24.0+dfsg-1ubuntu1Source reference:
/affected/9/versions - Fixed versions
- 24.0+dfsg-1ubuntu1.1
Source reference:
/affected/9/ranges - Prerequisites
- Not stated in this record
python-urllib3
Source reference: /affected/10/package/name
- Affected versions
- 1.26.16-1
Source reference:
/affected/10/versions1.26.18-1Source reference:
/affected/10/versions2.0.7-1Source reference:
/affected/10/versions - Fixed versions
- 2.0.7-1ubuntu0.1
Source reference:
/affected/10/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-pip",
"purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"1.4.1-2",
"1.5.4-1",
"1.5.4-1ubuntu1",
"1.5.4-1ubuntu3",
"1.5.4-1ubuntu4",
"1.5.4-1ubuntu4+esm1",
"1.5.4-1ubuntu4+esm2",
"1.5.4-1ubuntu4+esm3",
"1.5.4-1ubuntu4+esm4",
"1.5.4-1ubuntu4+esm5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-pip",
"binary_version": "1.5.4-1ubuntu4+esm5"
},
{
"binary_name": "python-pip-whl",
"binary_version": "1.5.4-1ubuntu4+esm5"
},
{
"binary_name": "python3-pip",
"binary_version": "1.5.4-1ubuntu4+esm5"
}
],
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.1-2ubuntu0.16.04.4+esm2"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=esm-infra%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"1.11-1",
"1.12-1",
"1.13.1-1",
"1.13.1-2",
"1.13.1-2ubuntu0.16.04.1",
"1.13.1-2ubuntu0.16.04.2",
"1.13.1-2ubuntu0.16.04.3",
"1.13.1-2ubuntu0.16.04.4",
"1.13.1-2ubuntu0.16.04.4+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-urllib3",
"binary_version": "1.13.1-2ubuntu0.16.04.4+esm2"
},
{
"binary_name": "python3-urllib3",
"binary_version": "1.13.1-2ubuntu0.16.04.4+esm2"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.1-2ubuntu0.6+esm10"
}
]
}
],
"package": {
"name": "python-pip",
"purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"1.5.6-7ubuntu1",
"1.5.6-7ubuntu2",
"8.0.2-7",
"8.0.3-1",
"8.0.3-2",
"8.1.0-1",
"8.1.0-2",
"8.1.1-1",
"8.1.1-2",
"8.1.1-2ubuntu0.1",
"8.1.1-2ubuntu0.2",
"8.1.1-2ubuntu0.4",
"8.1.1-2ubuntu0.6",
"8.1.1-2ubuntu0.6+esm2",
"8.1.1-2ubuntu0.6+esm3",
"8.1.1-2ubuntu0.6+esm4",
"8.1.1-2ubuntu0.6+esm5",
"8.1.1-2ubuntu0.6+esm6",
"8.1.1-2ubuntu0.6+esm8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-pip",
"binary_version": "8.1.1-2ubuntu0.6+esm10"
},
{
"binary_name": "python-pip-whl",
"binary_version": "8.1.1-2ubuntu0.6+esm10"
},
{
"binary_name": "python3-pip",
"binary_version": "8.1.1-2ubuntu0.6+esm10"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22-1ubuntu0.18.04.2+esm2"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=esm-infra%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"1.21.1-1",
"1.22-1",
"1.22-1ubuntu0.18.04.1",
"1.22-1ubuntu0.18.04.2",
"1.22-1ubuntu0.18.04.2+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-urllib3",
"binary_version": "1.22-1ubuntu0.18.04.2+esm2"
},
{
"binary_name": "python3-urllib3",
"binary_version": "1.22-1ubuntu0.18.04.2+esm2"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.1-2.3~ubuntu1.18.04.8+esm6"
}
]
}
],
"package": {
"name": "python-pip",
"purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"9.0.1-2",
"9.0.1-2.3~ubuntu1",
"9.0.1-2.3~ubuntu1.18.04.1",
"9.0.1-2.3~ubuntu1.18.04.2",
"9.0.1-2.3~ubuntu1.18.04.3",
"9.0.1-2.3~ubuntu1.18.04.4",
"9.0.1-2.3~ubuntu1.18.04.5",
"9.0.1-2.3~ubuntu1.18.04.5+esm2",
"9.0.1-2.3~ubuntu1.18.04.5+esm3",
"9.0.1-2.3~ubuntu1.18.04.6",
"9.0.1-2.3~ubuntu1.18.04.6+esm1",
"9.0.1-2.3~ubuntu1.18.04.7",
"9.0.1-2.3~ubuntu1.18.04.7+esm1",
"9.0.1-2.3~ubuntu1.18.04.8",
"9.0.1-2.3~ubuntu1.18.04.8+esm1",
"9.0.1-2.3~ubuntu1.18.04.8+esm2",
"9.0.1-2.3~ubuntu1.18.04.8+esm4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-pip",
"binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm6"
},
{
"binary_name": "python-pip-whl",
"binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm6"
},
{
"binary_name": "python3-pip",
"binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm6"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20.0.2-5ubuntu1.11"
}
]
}
],
"package": {
"name": "python-pip",
"purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"18.1-5",
"18.1-5build1",
"18.1-5ubuntu1",
"20.0.2-2",
"20.0.2-4",
"20.0.2-5",
"20.0.2-5ubuntu1",
"20.0.2-5ubuntu1.1",
"20.0.2-5ubuntu1.3",
"20.0.2-5ubuntu1.4",
"20.0.2-5ubuntu1.5",
"20.0.2-5ubuntu1.6",
"20.0.2-5ubuntu1.7",
"20.0.2-5ubuntu1.8",
"20.0.2-5ubuntu1.9",
"20.0.2-5ubuntu1.10"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-pip-whl",
"binary_version": "20.0.2-5ubuntu1.11"
},
{
"binary_name": "python3-pip",
"binary_version": "20.0.2-5ubuntu1.11"
}
],
"availability": "No subscription required",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.8-2ubuntu0.4"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.24.1-1ubuntu1",
"1.24.1-1ubuntu2",
"1.25.8-1",
"1.25.8-2",
"1.25.8-2ubuntu0.1",
"1.25.8-2ubuntu0.2",
"1.25.8-2ubuntu0.3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-urllib3",
"binary_version": "1.25.8-2ubuntu0.4"
}
],
"availability": "No subscription required",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "22.0.2+dfsg-1ubuntu0.5"
}
]
}
],
"package": {
"name": "python-pip",
"purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"20.3.4-4",
"21.3.1+dfsg-3",
"22.0.2+dfsg-1",
"22.0.2+dfsg-1ubuntu0.1",
"22.0.2+dfsg-1ubuntu0.2",
"22.0.2+dfsg-1ubuntu0.3",
"22.0.2+dfsg-1ubuntu0.4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-pip",
"binary_version": "22.0.2+dfsg-1ubuntu0.5"
},
{
"binary_name": "python3-pip-whl",
"binary_version": "22.0.2+dfsg-1ubuntu0.5"
}
],
"availability": "No subscription required",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.5-1~exp1ubuntu0.2"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.26.5-1~exp1",
"1.26.5-1~exp1ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-urllib3",
"binary_version": "1.26.5-1~exp1ubuntu0.2"
}
],
"availability": "No subscription required",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "24.0+dfsg-1ubuntu1.1"
}
]
}
],
"package": {
"name": "python-pip",
"purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"23.2+dfsg-1",
"23.3+dfsg-1",
"24.0+dfsg-1",
"24.0+dfsg-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-pip",
"binary_version": "24.0+dfsg-1ubuntu1.1"
},
{
"binary_name": "python3-pip-whl",
"binary_version": "24.0+dfsg-1ubuntu1.1"
}
],
"availability": "No subscription required",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.7-1ubuntu0.1"
}
]
}
],
"package": {
"name": "python-urllib3",
"purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.26.16-1",
"1.26.18-1",
"2.0.7-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-37891.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-urllib3",
"binary_version": "2.0.7-1ubuntu0.1"
}
],
"availability": "No subscription required",
"priority_reason": "Per urllib3 developers, this is a highly unlikely scenario"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #13773 · Revision 1
- Added to Heist Feed
- Publisher date