RHSA-2020:0851: Moderate: python-virtualenv security update
The virtualenv tool creates isolated Python environments. The virtualenv tool is a successor to workingenv, and an extension of virtual-python.Security Fix(es): python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060) python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236) python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:0851?
The severity of RHSA-2020:0851 is classified as critical due to the potential for credential exposure.
How do I fix RHSA-2020:0851?
To fix RHSA-2020:0851, update the python-virtualenv package to version 15.1.0-4.el7_7 or later.
What software is affected by RHSA-2020:0851?
The software affected by RHSA-2020:0851 is python-virtualenv versions prior to 15.1.0-4.el7_7.
What is the nature of the vulnerability in RHSA-2020:0851?
The vulnerability in RHSA-2020:0851 involves a cross-host redirect that fails to remove the Authorization header, leading to credential exposure.
When was RHSA-2020:0851 released?
RHSA-2020:0851 was released to address the security vulnerability on a specified date in 2020.