Bug 33716 - python-urllib3 new security issue CVE-2024-37891
Summary: python-urllib3 new security issue CVE-2024-37891
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-11-04 14:11 CET by Nicolas Salguero
Modified: 2024-11-08 23:10 CET (History)
3 users (show)

See Also:
Source RPM: python-urllib3-1.26.18-4.mga9.src.rpm
CVE: CVE-2024-37891
Status comment: Patch available from Ubuntu

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Salguero 2024-11-04 14:11:44 CET 
Ubuntu has issued an advisory on October 29:
https://ubuntu.com/security/notices/USN-7084-1

Patch: https://launchpad.net/ubuntu/+source/python-urllib3/1.26.5-1~exp1ubuntu0.2
Nicolas Salguero 2024-11-04 14:12:18 CET

CVE: (none) => CVE-2024-37891
Status comment: (none) => Patch available from Ubuntu
Source RPM: (none) => python-urllib3-1.26.18-4.mga9.src.rpm

Comment 1 Lewis Smith 2024-11-04 20:50:10 CET 
Once more, thanks for the patch ref. I cannot always find them.

Assigning to Python stack maintainers.

Assignee: bugsquad => python

Comment 2 David GEIGER 2024-11-05 06:55:35 CET 
Assigning to QA,

Packages in 9/Core/Updates_testing:
======================
python3-urllib3+brotli-1.26.20-1.mga9.noarch.rpm
python3-urllib3+socks-1.26.20-1.mga9.noarch.rpm
python3-urllib3-1.26.20-1.mga9.noarch.rpm

From SRPMS
python-urllib3-1.26.20-1.mga9.src.rpm

CC: (none) => geiger.david68210
Assignee: python => qa-bugs

katnatek 2024-11-05 18:27:11 CET

Keywords: (none) => advisory

Comment 3 katnatek 2024-11-05 23:27:24 CET 
RH x86_64

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (32-bit)" is up-to-date
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Nonfree 32bit Updates (distrib37)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date
medium "BDK-Free-x86_64" is up-to-date
medium "BDK-Free-noarch" is up-to-date
medium "BDK-NonFree-x86_64" is up-to-date


installing python3-urllib3-1.26.20-1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: python3-urllib3       ##################################################################################################
      1/1: removing python3-urllib3-1.26.18-4.mga9.noarch
                                 ##################################################################################################

yt-dlp requires this

Download video with yt-dlp, play the video OK

Not founs POC
katnatek 2024-11-08 01:32:31 CET

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2024-11-08 02:26:42 CET 
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 5 Mageia Robot 2024-11-08 23:10:37 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0347.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.