Security vulnerability in bundled urllib3 (CVE-2023-43804)

[frenzymadness]

Description

In the current version of bundled urllib3 (1.26.16), there is a security vulnerability CVE-2023-43804 - https://nvd.nist.gov/vuln/detail/CVE-2023-43804:

urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.

From my point of view, there is no way to exploit that vulnerability via pip. pip does not allow users to specify cookies when sending requests to custom indexes.

I also tried to implement HTTP server that sends cookies to the user (HTTP header Set-Cookie) and then redirects the user to a different URL to see whether it can leak the content of the cookie when this server is used as an index for pip. It seems it doesn't work and the cookie received in the first response from the server is not sent back in the second request to the different URL by pip.

Bundled urrlib3 will be updated sooner or later. I just want to asses the possible risk users of pip with vulnerable bundled urllib3 might face.

Expected behavior

No response

pip version

23.2.1

Python version

3.11

OS

Fedora Linux

How to Reproduce

There is nothing to reproduce.

Output

No response

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[uranusjr]

I don’t think there’s any way a user can supply a custom header so the vulnarability does not seem relevant at all.

[frenzymadness]

Thank you @uranusjr ! I ended up with the same conclusion. For the aforementioned reasons, there is no need to hurry up with updating bundled urllib3 and therefore this issue can be closed, if you don't plan to investigate it further.

[uranusjr]

Has urllib3 released a version with a fix? If it does, it’s still in time for 23.3 due this month.

[frenzymadness]

Has urllib3 released a version with a fix? If it does, it’s still in time for 23.3 due this month.

Yes, v1.26.17 and v2.0.6 are fixed.

[uranusjr]

Nice. Merging this into the release issue then.