RHSA-2020:1916-01 -- Redhat python-pipID: oval:org.secpod.oval:def:66813 | Date: (C)2020-11-09 (M)2024-05-22 |
Class: PATCH | Family: unix |
pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package Index . pip is a recursive acronym that can stand for either Pip Installs Packages or Pip Installs Python. Security Fix: * python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure * python-urllib3: CRLF injection due to not encoding the "\r\n" sequence leading to possible attack on internal service * python-urllib3: Certification mishandle when error should be thrown * python-requests: Redirect from HTTPS to HTTP does not remove Authorization header For more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. Additional Changes: For detailed information on changes in this release, see the CentOS 8.2 Release Notes linked from the References section.