CVE-2023-43804

Name	CVE-2023-43804
Description	urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3610-1, DLA-3998-1
Debian Bugs	1053626

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-urllib3 (PTS)	bullseye	1.26.5-1~exp1	vulnerable
	bullseye (security)	1.26.5-1~exp1+deb11u1	fixed
	bookworm	1.26.12-1+deb12u1	fixed
	trixie	2.2.3-4	fixed
	sid	2.3.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
python-urllib3	source	buster	1.24.1-1+deb10u1	DLA-3610-1
python-urllib3	source	bullseye	1.26.5-1~exp1+deb11u1	DLA-3998-1
python-urllib3	source	bookworm	1.26.12-1+deb12u1
python-urllib3	source	(unstable)	1.26.17-1		1053626

Notes

https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb (1.26.17)