Debian alert DLA-4651-1 (python-urllib3)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4651-1] python-urllib3 security update
Date:
             
 
Fri, 26 Jun 2026 11:03:27 +0200
Message-ID:
             
 
<aj5AX9YvUah52Gpf@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4651-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
June 26, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python-urllib3
Version        : 1.26.5-1~exp1+deb11u4 1.26.12-1+deb12u4
CVE ID         : CVE-2026-44431
Debian Bug     : 1136653

It was discovered that python-urllib3, an HTTP library with thread-safe
connection pooling for Python, did not strip out sensitive headers (such
as `Authorization` or `Cookie`) during cross-origin redirects followed
from the low-level API, which could lead to information disclosure or
authorization bypass.

For Debian 11 bullseye, this problem has been fixed in version
1.26.5-1~exp1+deb11u4.

For Debian 12 bookworm, this problem has been fixed in version
1.26.12-1+deb12u4.

We recommend that you upgrade your python-urllib3 packages.

For the detailed security status of python-urllib3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-urllib3

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmo+QF8ACgkQ05pJnDwh
pVJsSg/+LEnnt1pQJAt2xkbAXQQccZIX825socB9oq1HcO+wQ26Wz/KuZjFRvxD5
PBDThwr762RYsLIrxHSOYiZebZhmc32+y0d2KjXbZauY3mEKbt+I4iNh6YIfdH2i
D0HtWg4p0KsPiR6hBUCdbc/CBU5e4+ihAYssZ1tqMZYr9WWpkVjZVOqtFdw6rSpH
dIvDMAq2fpnQkXzzsOp+amYe97XYG7jRCFaKTApVKVDX7ytFMXfUwmvYlqdQ7Hh2
mU28UzxAxnqQ6cq+6sMZaaw5WSfJSkySZTWHMCWnqI4QVdmXNACss+ujmgfyU7RG
jQEoPHyGvW2r+8yJy68/lsvaSEb8yaW0xKEfDotEmnLFdPSXLkUMukHdUEiikcYQ
l5J1rGI4RuN/z7IJ74nsui6tYLsobqiQO64AcMFfA/q47yX0ej3Us5umcVwDy+r8
FMajA+WGp6hulRWvNV4zPTaD0F6+Q4ruGsEKZj60FMAYEl4h5MPkZ/PPC5PFT9Np
cU0GwMJgftcWvW4U8ZWf6AB+n2n9rhsSuD2VGcS6VAM11Le2dtnJMJolt/f5aS6M
mWdvf/gLaL2+1S2HWGrOq9t3UUK6uIoFCQUMhxN8lEqES8yqiB2M+nGqGjWj3cri
51eE8Wh8IASjGxnF/b/jroULOHEBlSKppuJnRJcz4Ryu2lpIdUU=
=GmBg
-----END PGP SIGNATURE-----