SUSE alert SUSE-SU-2021:2195-1 (python-urllib3, python-requests)

From:
             
 
sle-security-updates@lists.suse.com
To:
             
 
sle-security-updates@lists.suse.com
Subject:
             
 
SUSE-SU-2021:2195-1: moderate: Security update for python-urllib3, python-requests
Date:
             
 
Mon, 28 Jun 2021 22:11:16 +0200
Message-ID:
             
 
<20210628201116.3F9E5F78F@maintenance.suse.de>

   SUSE Security Update: Security update for python-urllib3, python-requests
______________________________________________________________________________

Announcement ID:    SUSE-SU-2021:2195-1
Rating:             moderate
References:         #1176784 #1182421 #1187045 ECO-3105 ECO-3352 
                    
Cross-References:   CVE-2021-33503
CVSS scores:
                    CVE-2021-33503 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:
                    SUSE OpenStack Cloud Crowbar 8
                    SUSE OpenStack Cloud 8
                    HPE Helion Openstack 8
______________________________________________________________________________

   An update that solves one vulnerability, contains two
   features and has two fixes is now available.

Description:

   This update for python-urllib3 and python-requests fixes the following
   issues:

   Security fix:

   - Improve performance of sub-authority splitting in URL. (bsc#1187045,
     CVE-2021-33503)

   Non-security changes:

   - Update python-urllib3 to version 1.25.10 to stay compatible with changes
     needed in the Server and Public Cloud products. (bsc#1182421,
     jsc#ECO-3352)
   - Update python-requests to version 2.24.0 to stay compatible with changes
     needed in the Server and Public Cloud products. (bsc#1176784,
     jsc#ECO-3105))


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud Crowbar 8:

      zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2021-2195=1

   - SUSE OpenStack Cloud 8:

      zypper in -t patch SUSE-OpenStack-Cloud-8-2021-2195=1

   - HPE Helion Openstack 8:

      zypper in -t patch HPE-Helion-OpenStack-8-2021-2195=1



Package List:

   - SUSE OpenStack Cloud Crowbar 8 (noarch):

      python-requests-2.24.0-3.3.1
      python-urllib3-1.25.10-5.19.1

   - SUSE OpenStack Cloud 8 (noarch):

      python-requests-2.24.0-3.3.1
      python-urllib3-1.25.10-5.19.1

   - HPE Helion Openstack 8 (noarch):

      python-requests-2.24.0-3.3.1
      python-urllib3-1.25.10-5.19.1


References:

   https://www.suse.com/security/cve/CVE-2021-33503.html
   https://bugzilla.suse.com/1176784
   https://bugzilla.suse.com/1182421
   https://bugzilla.suse.com/1187045