REDHAT-BUG-2419455: High severity pypi/urllib3 vulnerability
urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
urllib3to a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2419455?
REDHAT-BUG-2419455 has a high severity level due to its potential for causing excessive CPU and memory usage.
How do I fix REDHAT-BUG-2419455?
To fix REDHAT-BUG-2419455, update urllib3 to a version greater than 2.6.0.
What versions of urllib3 are affected by REDHAT-BUG-2419455?
REDHAT-BUG-2419455 affects urllib3 versions from 1.24 up to but not including 2.6.0.
What type of vulnerability is REDHAT-BUG-2419455?
REDHAT-BUG-2419455 is a vulnerability related to unlimited decompression chains that can lead to resource exhaustion.
Who reported REDHAT-BUG-2419455?
REDHAT-BUG-2419455 was reported by users within the Red Hat community concerning the urllib3 library.