rpm package
suse/python-urllib3&distro=SUSE OpenStack Cloud 7
pkg:rpm/suse/python-urllib3&distro=SUSE%20OpenStack%20Cloud%207
Vulnerabilities (15)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-20933 | — | < 1.16-3.12.1 | 1.16-3.12.1 | Nov 19, 2020 | InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret). | ||
| CVE-2020-24303 | — | < 1.16-3.12.1 | 1.16-3.12.1 | Oct 28, 2020 | Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. | ||
| CVE-2020-26137 | — | < 1.16-3.12.1 | 1.16-3.12.1 | Sep 29, 2020 | urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. | ||
| CVE-2020-26116 | — | < 1.16-3.15.1 | 1.16-3.15.1 | Sep 27, 2020 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.reque | ||
| CVE-2019-15043 | — | < 1.16-3.9.2 | 1.16-3.9.2 | Sep 3, 2019 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana. | ||
| CVE-2019-5477 | — | < 1.16-3.9.2 | 1.16-3.9.2 | Aug 16, 2019 | A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input a | ||
| CVE-2019-11236 | — | < 1.16-3.6.1 | 1.16-3.6.1 | Apr 15, 2019 | In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. | ||
| CVE-2019-9740 | — | < 1.16-3.6.1 | 1.16-3.6.1 | Mar 13, 2019 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string | ||
| CVE-2018-19039 | — | < 1.16-3.9.2 | 1.16-3.9.2 | Dec 13, 2018 | Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions. | ||
| CVE-2018-20060 | — | < 1.16-3.6.1 | 1.16-3.6.1 | Dec 11, 2018 | urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted i | ||
| CVE-2018-18074 | — | < 1.22-3.20.1 | 1.22-3.20.1 | Oct 9, 2018 | The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. | ||
| CVE-2018-15727 | — | < 1.16-3.9.2 | 1.16-3.9.2 | Aug 29, 2018 | Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. | ||
| CVE-2016-8611 | — | < 1.16-3.12.1 | 1.16-3.12.1 | Jul 31, 2018 | A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation. | ||
| CVE-2016-10127 | Cri | 9.0 | < 1.16-3.9.2 | 1.16-3.9.2 | Mar 3, 2017 | PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response. | |
| CVE-2015-2296 | — | < 1.22-3.20.1 | 1.22-3.20.1 | Mar 18, 2015 | The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. |
- CVE-2019-20933Nov 19, 2020affected < 1.16-3.12.1fixed 1.16-3.12.1
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
- CVE-2020-24303Oct 28, 2020affected < 1.16-3.12.1fixed 1.16-3.12.1
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
- CVE-2020-26137Sep 29, 2020affected < 1.16-3.12.1fixed 1.16-3.12.1
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
- CVE-2020-26116Sep 27, 2020affected < 1.16-3.15.1fixed 1.16-3.15.1
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.reque
- CVE-2019-15043Sep 3, 2019affected < 1.16-3.9.2fixed 1.16-3.9.2
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
- CVE-2019-5477Aug 16, 2019affected < 1.16-3.9.2fixed 1.16-3.9.2
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input a
- CVE-2019-11236Apr 15, 2019affected < 1.16-3.6.1fixed 1.16-3.6.1
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
- CVE-2019-9740Mar 13, 2019affected < 1.16-3.6.1fixed 1.16-3.6.1
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string
- CVE-2018-19039Dec 13, 2018affected < 1.16-3.9.2fixed 1.16-3.9.2
Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.
- CVE-2018-20060Dec 11, 2018affected < 1.16-3.6.1fixed 1.16-3.6.1
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted i
- CVE-2018-18074Oct 9, 2018affected < 1.22-3.20.1fixed 1.22-3.20.1
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
- CVE-2018-15727Aug 29, 2018affected < 1.16-3.9.2fixed 1.16-3.9.2
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
- CVE-2016-8611Jul 31, 2018affected < 1.16-3.12.1fixed 1.16-3.12.1
A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.
- affected < 1.16-3.9.2fixed 1.16-3.9.2
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
- CVE-2015-2296Mar 18, 2015affected < 1.22-3.20.1fixed 1.22-3.20.1
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.