CVE-2023-43804 json
`Cookie` HTTP header isn't stripped on cross-origin redirects
published 2023-10-02 3 y ago modified 2026-09-10 1 mo ago also GHSA-v845-jxx5-vc9f , PYSEC-2023-192 , EUVD-2023-0252
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Patch / fix
- pypi urllib3 1.26.17, 2.0.6
- python urllib3 1.26.17, 2.0.6
- python-urllib3 Debian 12 1.26.12-1+deb12u1
- python-urllib3 Debian 14, Debian 13 1.26.17-1
debian advisories DEBIAN-CVE-2023-43804
- python-pip Ubuntu 20.04 LTS 20.0.2-5ubuntu1.10
- python-pip Ubuntu 22.04 LTS 22.0.2+dfsg-1ubuntu0.4
- python-urllib3 Ubuntu 20.04 LTS 1.25.8-2ubuntu0.3
- python-urllib3 Ubuntu 22.04 LTS 1.26.5-1~exp1ubuntu0.1
- python-pip Ubuntu Pro 16.04 LTS 8.1.1-2ubuntu0.6+esm6
- python-pip Ubuntu Pro 18.04 LTS 9.0.1-2.3~ubuntu1.18.04.8+esm2
- python-urllib3 Ubuntu Pro 16.04 LTS 1.13.1-2ubuntu0.16.04.4+esm1
- python-urllib3 Ubuntu Pro 18.04 LTS 1.22-1ubuntu0.18.04.2+esm1
ubuntu advisories UBUNTU-CVE-2023-43804
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- pytz RHEL 8 2017.2-13.module+el8.9.0+19487+7dc18407
- babel RHEL 8 2.5.1-10.module+el8.9.0+19487+7dc18407
- numpy RHEL 8 1:1.14.2-16.module+el8.9.0+19487+7dc18407
- scipy RHEL 8 1.0.0-22.module+el8.9.0+19487+7dc18407
- Cython RHEL 8 0.28.1-7.module+el8.9.0+19487+7dc18407
- pytest RHEL 8 3.4.2-13.module+el8.9.0+19487+7dc18407
- PyYAML RHEL 8 3.12-16.module+el8.9.0+19487+7dc18407
- python2 RHEL 8 2.7.18-17.module+el8.10.0+20822+a15ec22d
red hat advisories RHSA-2024:2987RHSA-2024:2985RHSA-2023:6158RHSA-2024:2986RHSA-2024:2159RHSA-2024:0588
- python-urllib3 OpenStack Cloud Crowbar 9, OpenStack Cloud 9 1.23-3.25.1
- python-urllib3 OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.25.10-5.22.1
- python-urllib3 SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, SLE Micro 5.5 +6 more 1.25.10-150300.4.6.1
- python-urllib3 SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +2 more 1.25.10-3.34.1
suse advisories SUSE-SU-2023:4352-1SUSE-SU-2023:4157-1SUSE-SU-2023:4108-1SUSE-SU-2023:4064-1
- python-urllib3 openSUSE Tumbleweed 2.8.0-1.1
- python-urllib3_1 openSUSE Tumbleweed 1.26.20-7.2
- python-urllib3 openSUSE Tumbleweed 2.0.6-1.1
opensuse advisories openSUSE-SU-2026:12044-1openSUSE-SU-2026:12045-1openSUSE-SU-2024:13301-1
- python39 AlmaLinux 8 3.9.18-3.module_el8.10.0+3765+2f9a457d
- python39-py AlmaLinux 8 1.10.0-1.module_el8.6.0+2780+a40f65e1
- python39-pip AlmaLinux 8 20.2.4-9.module_el8.10.0+3765+2f9a457d
- python39-ply AlmaLinux 8 3.11-10.module_el8.6.0+2780+a40f65e1
- python39-six AlmaLinux 8 1.15.0-3.module_el8.6.0+2780+a40f65e1
- python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+2780+a40f65e1
- python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+3248+c431e88c
- python39-idle AlmaLinux 8 3.9.18-3.module_el8.10.0+3765+2f9a457d
almalinux advisories ALSA-2024:2985ALSA-2024:2986ALSA-2024:2987ALSA-2024:2159ALSA-2024:0464ALSA-2024:0116
- pytz Rocky Linux 8 2017.2-13.module+el8.10.0+1817+0b01df83
- babel Rocky Linux 8 2.5.1-10.module+el8.9.0+1531+a18208f5
- numpy Rocky Linux 8 1:1.14.2-16.module+el8.9.0+1531+a18208f5
- scipy Rocky Linux 8 1.0.0-22.module+el8.10.0+1817+0b01df83
- Cython Rocky Linux 8 0.28.1-7.module+el8.9.0+1531+a18208f5
- pytest Rocky Linux 8 3.4.2-13.module+el8.9.0+1531+a18208f5
- PyYAML Rocky Linux 8 3.12-16.module+el8.9.0+1531+a18208f5
- python2 Rocky Linux 8 2.7.18-17.module+el8.10.0+1813+4b021305.rocky.0.2
rocky linux advisories RLSA-2024:2987RLSA-2024:2985RLSA-2024:2986
- py3-urllib3 Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 1.26.17-r0
alpine advisories ALPINE-CVE-2023-43804
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python-urllib3 CBL-Mariner 2.0 1.26.18-1
- python-urllib3 Azure Linux 3.0 2.0.7-1
- python3 CBL-Mariner 2.0 3.9.19-13
azure linux advisories AZL-31108AZL-35444AZL-59696
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-43804 updated cvss 5.9
python-urllib3: Cookie request header isn't stripped during cross-origin redirects
-
Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-baremetal-containeraffected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux 6 python-urllib3 Red Hat Enterprise Linux 7 python-pip, python3-pip, python-urllib3, resource-agents, python-s3transfer, resource-agents-gcp, +5 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat OpenShift Container Platform 3.11 python-urllib3, python2-urllib3affected: workaround, no fix available
-
Red Hat OpenShift Container Platform 4 openshift4/cnf-tests-rhel8, openshift4/baremetal-hardware-event-proxy-rhel8affected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Data Science (RHODS) rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-ml-pipelines-api-server-rhel8, rhods/odh-ml-pipelines-artifact-manager-rhel8, rhods/odh-ml-pipelines-persistenceagent-rhel8, rhods/odh-ml-pipelines-viewercontroller-rhel8, rhods/odh-ml-pipelines-scheduledworkflow-rhel8affected: workaround, no fix available
-
Red Hat OpenStack Platform 16.2 python-botocore, python3-botocoreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Satellite 6 python-urllib3, python3-urllib3affected: workaround, no fix available
-
Red Hat Software Collections rh-python38-python-pip, rh-python38-python-urllib3, rh-python38-python-pip-wheel Red Hat Storage 3 graphite-webaffected: workaround, no fix planned “Will not fix”
show 29 moreshow fewer
-
Red Hat Quay v3 quay/quay-rhel8 v3.9.5-4, quay/clair-rhel8 v3.9.5-1, quay/quay-builder-rhel8 v3.9.5-1, quay/quay-operator-rhel8 v3.9.5-2, quay/quay-operator-bundle v3.9.5-5, quay/quay-bridge-operator-rhel8 v3.9.5-1, +4 morefixed: vendor fix RHBA-2023:6852
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-urllib3 1.26.18-1.el8ap, python3x-urllib3 1.26.18-1.el8ap, automation-controller-venv-tower 4.5.1-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-urllib3 1.26.18-1.el9ap, python3-urllib3 1.26.18-1.el9ap, automation-controller-venv-tower 4.5.1-1.el9apfixed: vendor fix RHSA-2024:0733
-
Red Hat Enterprise Linux AppStream (v. 8) fence-agents 4.2.1-121.el8_9.2, python3.11-urllib3 1.26.12-2.el8, fence-agents-all 4.2.1-121.el8_9.2, fence-agents-apc 4.2.1-121.el8_9.2, fence-agents-eps 4.2.1-121.el8_9.2, fence-agents-rsa 4.2.1-121.el8_9.2, +182 morefixed: vendor fix RHSA-2024:2987
-
Red Hat Enterprise Linux AppStream (v. 9) fence-virt 4.10.0-55.el9_3.2, fence-virtd 4.10.0-55.el9_3.2, fence-agents 4.10.0-55.el9_3.2, python3.11-urllib3 1.26.12-2.el9, fence-virtd-cpg 4.10.0-55.el9_3.2, fence-virtd-tcp 4.10.0-55.el9_3.2, +9 morefixed: vendor fix RHSA-2023:7753
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) fence-agents 4.2.1-41.el8_2.12, fence-agents-all 4.2.1-41.el8_2.12, fence-agents-apc 4.2.1-41.el8_2.12, fence-agents-eps 4.2.1-41.el8_2.12, fence-agents-rsa 4.2.1-41.el8_2.12, fence-agents-rsb 4.2.1-41.el8_2.12, +32 morefixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents 4.2.1-65.el8_4.13, fence-agents-all 4.2.1-65.el8_4.13, fence-agents-apc 4.2.1-65.el8_4.13, fence-agents-eps 4.2.1-65.el8_4.13, fence-agents-rsa 4.2.1-65.el8_4.13, fence-agents-rsb 4.2.1-65.el8_4.13, +36 morefixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux AppStream E4S (v. 8.1) fence-agents 4.2.1-30.el8_1.10, fence-agents-all 4.2.1-30.el8_1.10, fence-agents-apc 4.2.1-30.el8_1.10, fence-agents-eps 4.2.1-30.el8_1.10, fence-agents-rsa 4.2.1-30.el8_1.10, fence-agents-rsb 4.2.1-30.el8_1.10, +33 morefixed: vendor fix RHSA-2023:6812
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) fence-agents 4.2.1-41.el8_2.12, fence-agents-all 4.2.1-41.el8_2.12, fence-agents-apc 4.2.1-41.el8_2.12, fence-agents-eps 4.2.1-41.el8_2.12, fence-agents-rsa 4.2.1-41.el8_2.12, fence-agents-rsb 4.2.1-41.el8_2.12, +33 morefixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) fence-agents 4.2.1-65.el8_4.13, fence-agents-all 4.2.1-65.el8_4.13, fence-agents-apc 4.2.1-65.el8_4.13, fence-agents-eps 4.2.1-65.el8_4.13, fence-agents-rsa 4.2.1-65.el8_4.13, fence-agents-rsb 4.2.1-65.el8_4.13, +37 morefixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) fence-agents 4.2.1-89.el8_6.10, fence-agents-all 4.2.1-89.el8_6.10, fence-agents-apc 4.2.1-89.el8_6.10, fence-agents-eps 4.2.1-89.el8_6.10, fence-agents-rsa 4.2.1-89.el8_6.10, fence-agents-rsb 4.2.1-89.el8_6.10, +37 morefixed: vendor fix RHSA-2023:7407
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) fence-agents 4.2.1-112.el8_8.2, fence-agents-all 4.2.1-112.el8_8.2, fence-agents-apc 4.2.1-112.el8_8.2, fence-agents-eps 4.2.1-112.el8_8.2, fence-agents-rsa 4.2.1-112.el8_8.2, fence-agents-rsb 4.2.1-112.el8_8.2, +37 morefixed: vendor fix RHSA-2023:7528
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) fence-virt 4.10.0-20.el9_0.10, fence-virtd 4.10.0-20.el9_0.10, fence-agents 4.10.0-20.el9_0.10, fence-virtd-cpg 4.10.0-20.el9_0.10, fence-virtd-tcp 4.10.0-20.el9_0.10, fence-agents-virsh 4.10.0-20.el9_0.10, +9 morefixed: vendor fix RHSA-2023:7385
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) fence-virt 4.10.0-43.el9_2.2, fence-virtd 4.10.0-43.el9_2.2, fence-agents 4.10.0-43.el9_2.2, fence-virtd-cpg 4.10.0-43.el9_2.2, fence-virtd-tcp 4.10.0-43.el9_2.2, fence-agents-virsh 4.10.0-43.el9_2.2, +8 morefixed: vendor fix RHSA-2023:7378
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) fence-agents 4.2.1-41.el8_2.12, fence-agents-all 4.2.1-41.el8_2.12, fence-agents-apc 4.2.1-41.el8_2.12, fence-agents-eps 4.2.1-41.el8_2.12, fence-agents-rsa 4.2.1-41.el8_2.12, fence-agents-rsb 4.2.1-41.el8_2.12, +32 morefixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) fence-agents 4.2.1-65.el8_4.13, fence-agents-all 4.2.1-65.el8_4.13, fence-agents-apc 4.2.1-65.el8_4.13, fence-agents-eps 4.2.1-65.el8_4.13, fence-agents-rsa 4.2.1-65.el8_4.13, fence-agents-rsb 4.2.1-65.el8_4.13, +36 morefixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux BaseOS (v. 8) python-urllib3 1.24.2-5.el8_9.2, python3-urllib3 1.24.2-5.el8_9.2fixed: vendor fix RHSA-2024:0116
-
Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3 1.26.5-3.el9_3.1, python3-urllib3 1.26.5-3.el9_3.1fixed: vendor fix RHSA-2024:0464
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) python-urllib3 1.24.2-5.el8_6.1, python3-urllib3 1.24.2-5.el8_6.1fixed: vendor fix RHSA-2024:0300
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) python-urllib3 1.24.2-5.el8_8.1, python3-urllib3 1.24.2-5.el8_8.1fixed: vendor fix RHSA-2024:0588
-
Red Hat Enterprise Linux CRB (v. 8) pytest 6.0.2-2.module+el8.9.0+19644+d68f775d, Cython 0.29.21-5.module+el8.9.0+19644+d68f775d, pybind11 2.7.1-1.module+el8.9.0+19644+d68f775d, python-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python39-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python-attrs 20.3.0-2.module+el8.9.0+19644+d68f775d, +16 morefixed: vendor fix RHSA-2024:2985
-
Red Hat Enterprise Linux High Availability (v. 8) fence-agents-aws 4.2.1-121.el8_9.2, fence-agents-gce 4.2.1-121.el8_9.2, fence-agents-aliyun 4.2.1-121.el8_9.2, fence-agents-azure-arm 4.2.1-121.el8_9.2, fence-agents-openstack 4.2.1-121.el8_9.2fixed: vendor fix RHSA-2024:0133
-
Red Hat Enterprise Linux High Availability (v. 9) fence-agents-all 4.10.0-55.el9_3.2, fence-agents-apc 4.10.0-55.el9_3.2, fence-agents-aws 4.10.0-55.el9_3.2, fence-agents-eps 4.10.0-55.el9_3.2, fence-agents-gce 4.10.0-55.el9_3.2, fence-agents-rsa 4.10.0-55.el9_3.2, +36 morefixed: vendor fix RHSA-2023:7753
-
Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aws 4.2.1-65.el8_4.13, fence-agents-gce 4.2.1-65.el8_4.13, fence-agents-aliyun 4.2.1-65.el8_4.13, fence-agents-azure-arm 4.2.1-65.el8_4.13fixed: vendor fix RHSA-2023:7523
-
Red Hat Enterprise Linux High Availability E4S (v. 8.1) fence-agents-aws 4.2.1-30.el8_1.10, fence-agents-gce 4.2.1-30.el8_1.10, fence-agents-aliyun 4.2.1-30.el8_1.10, fence-agents-azure-arm 4.2.1-30.el8_1.10fixed: vendor fix RHSA-2023:6812
-
Red Hat Enterprise Linux High Availability E4S (v. 8.2) fence-agents-aws 4.2.1-41.el8_2.12, fence-agents-gce 4.2.1-41.el8_2.12, fence-agents-aliyun 4.2.1-41.el8_2.12, fence-agents-azure-arm 4.2.1-41.el8_2.12fixed: vendor fix RHSA-2023:7435
-
Red Hat Enterprise Linux High Availability EUS (v.8.6) fence-agents-aws 4.2.1-89.el8_6.10, fence-agents-gce 4.2.1-89.el8_6.10, fence-agents-aliyun 4.2.1-89.el8_6.10, fence-agents-azure-arm 4.2.1-89.el8_6.10fixed: vendor fix RHSA-2023:7407
-
Red Hat Enterprise Linux High Availability EUS (v.8.8) fence-agents-aws 4.2.1-112.el8_8.2, fence-agents-gce 4.2.1-112.el8_8.2, fence-agents-aliyun 4.2.1-112.el8_8.2, fence-agents-azure-arm 4.2.1-112.el8_8.2, fence-agents-openstack 4.2.1-112.el8_8.2fixed: vendor fix RHSA-2023:7528
-
Red Hat Enterprise Linux High Availability EUS (v.9.0) fence-agents-all 4.10.0-20.el9_0.10, fence-agents-apc 4.10.0-20.el9_0.10, fence-agents-aws 4.10.0-20.el9_0.10, fence-agents-eps 4.10.0-20.el9_0.10, fence-agents-gce 4.10.0-20.el9_0.10, fence-agents-rsa 4.10.0-20.el9_0.10, +36 morefixed: vendor fix RHSA-2023:7385
-
Red Hat Enterprise Linux High Availability EUS (v.9.2) fence-agents-all 4.10.0-43.el9_2.2, fence-agents-apc 4.10.0-43.el9_2.2, fence-agents-aws 4.10.0-43.el9_2.2, fence-agents-eps 4.10.0-43.el9_2.2, fence-agents-gce 4.10.0-43.el9_2.2, fence-agents-rsa 4.10.0-43.el9_2.2, +36 morefixed: vendor fix RHSA-2023:7378
11 more fixed, 5 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.36% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | urllib3 | >=2.0.0, <2.0.6 <1.26.17 |
2.0.6 1.26.17 |
Affected products
- urllib3 urllib3
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb
web, patch
-
github.com
/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d
web, patch
-
github.com
/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
web, patch, vendor-advisory, advisory
-
lists.debian.org
/debian-lts-announce/2023/10/msg00012.html
web, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY/
mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ/
mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/
mailing-list, third-party-advisory
-
vicarius.io
/vsociety/posts/cve-2023-43804-urllib3-vulnerability-3
web
- security.netapp.com /advisory/ntap-20241213-0007/
-
lists.debian.org
/debian-lts-announce/2024/12/msg00020.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-43804
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-192.yaml
web
-
github.com
/urllib3/urllib3
package
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ
web
-
security.netapp.com
/advisory/ntap-20241213-0007
web
Sources
- CVE List CVE-2023-43804
- GitHub Advisory GHSA-v845-jxx5-vc9f
- NVD CVE-2023-43804
- OSV PYSEC-2023-192
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.