RHSA-2020:2081: Moderate: python-virtualenv security update
The virtualenv tool creates isolated Python environments. The virtualenv tool is a successor to workingenv, and an extension of virtual-python.Security Fix(es): python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060) python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236) python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:2081?
The severity of RHSA-2020:2081 is classified as important due to the potential for credential exposure.
How do I fix RHSA-2020:2081?
To fix RHSA-2020:2081, update the python-virtualenv package to version 15.1.0-4.el7_8 or later.
What vulnerability does RHSA-2020:2081 address?
RHSA-2020:2081 addresses a cross-host redirect vulnerability in the python-urllib3 that can expose authorization credentials.
Is RHSA-2020:2081 applicable to all python-virtualenv installations?
RHSA-2020:2081 is applicable to python-virtualenv installations that are versions prior to 15.1.0-4.el7_8.
Who is affected by RHSA-2020:2081?
Users and systems utilizing the affected versions of python-virtualenv are at risk of the vulnerabilities outlined in RHSA-2020:2081.