The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3610 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3610-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     October 08, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-urllib3     Version        : 1.24.1-1+deb10u1     CVE ID         : CVE-2019-11236 CVE-2019-11324 CVE-2020-26137 CVE-2023-43804     Debian Bug     : 927172 927412 1053626

    Security vulnerabilities were found in python-urllib3, an HTTP library     with thread-safe connection pooling for Python, which could lead to     information disclosure or authorization bypass.

    CVE-2019-11236

        Hanno Bck discovered that an attacker controlling the request         parameter can inject headers by injecting CR/LF chars.  The issue is         similar to CPython's CVE-2019-9740.

    CVE-2019-11324

        Christian Heimes discovered that when verifying HTTPS connections         upon passing an SSLContext to urllib3, system CA certificates are         loaded into the SSLContext by default in addition to any         manually-specified CA certificates.
        This causes TLS handshakes that should fail given only the manually         specified certs to succeed based on system CA certs.

    CVE-2020-26137

        It was discovered that CRLF injection was possible if the attacker         controls the HTTP request method, as demonstrated by inserting CR         and LF control characters in the first argument of putrequest().
        The issue is similar to urllib's CVE-2020-26116.

    CVE-2023-43804

        It was discovered that the Cookie request header isn't stripped         during cross-origin redirects.  It is therefore possible for a user         specifying a Cookie header to unknowingly leak information via HTTP         redirects to a different origin (unless the user disables redirects         explicitly).  The issue is similar to CVE-2018-20060, but for Cookie         request header rather than Authorization.

        Moreover authorization request headers were not removed         redirecting to cross-site.  Per RFC7230 sec. 3.2 header fields are         to be treated case-insensitively.

    For Debian 10 buster, these problems have been fixed in version     1.24.1-1+deb10u1.

    We recommend that you upgrade your python-urllib3 packages.

    For the detailed security status of python-urllib3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-urllib3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3610 : python-urllib3 - security update

critical Nessus Plugin ID 182762

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Jan 22, 2025, 5:44 PM CVE (set "CVE" coverage to "CVE-2018-20060,CVE-2019-9740,CVE-2019-11236,CVE-2019-11324,CVE-2020-26116,CVE-2020-26137,CVE-2023-43804") CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202501221744
Version 1.1 Oct 16, 2023, 12:09 AM CVE (set "CVE" coverage to "CVE-2018-20060,CVE-2018-25091,CVE-2019-9740,CVE-2019-11236,CVE-2019-11324,CVE-2020-26116,CVE-2020-26137,CVE-2023-43804") Plugin metadata Plugin Feed: 202310160009
Version 1.0 Oct 8, 2023, 10:03 PM New Plugin Feed: 202310082203