Closed mend-for-github-com[bot] closed 11 months ago
@Djcarrillo6,
Can you please work on this High Severity Vulnerability. If you're interested in fixing the detected security vulnerability, it's a straightforward process. To bump urllib3 to the latest version, simply remove Python version 3.5 from noxfile.py and .github/workflows/test.yml. Before that just comment on this issue https://github.com/opensearch-project/opensearch-py/issues/430 saying removing end of life python version because of security vulnerability. You can follow this PR for guidance on the urllib3 upgrade.
Thank you.
Would be happy to @saimedhi! I would like to officially request assignment on this issue.
It looks like @Djcarrillo6 has fixed this issue. Should it be closed?
CVE-2023-43804 - High Severity Vulnerability
Vulnerable Library - urllib3-1.26.16-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/c5/05/c214b32d21c0b465506f95c4f28ccbcba15022e000b043b72b3df7728471/urllib3-1.26.16-py2.py3-none-any.whl
Dependency Hierarchy: - :x: **urllib3-1.26.16-py2.py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: 84ac172ddc54b3e6c975d36221d16ec3e78a2fe9
Found in base branch: main
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Publish Date: 2023-10-04
URL: CVE-2023-43804
CVSS 3 Score Details (8.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-43804
Release Date: 2023-10-04
Fix Resolution: 1.26.17