Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Python dependency - urllib3 from v1.25.8 to v1.25.9 #1123

Merged
merged 1 commit into from
Jul 3, 2022
Merged

Update Python dependency - urllib3 from v1.25.8 to v1.25.9 #1123

merged 1 commit into from
Jul 3, 2022

Conversation

PeterDaveHello
Copy link
Contributor

@PeterDaveHello PeterDaveHello commented Jun 30, 2022 •
edited
Loading

Description

Update Python dependency - urllib3 from v1.25.8 to v1.25.9

Motivation and Context

There's a high severity CVE in current version of urllib3

https://www.cve.org/CVERecord?id=CVE-2020-26137

urllib3 before 1.25.9 allows CRLF injection if the attacker controls
the HTTP request method, as demonstrated by inserting CR and LF
control characters in the first argument of putrequest().

NOTE: this is similar to CVE-2020-26116.

How Has This Been Tested?

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.

@yubiuser
Copy link
Member

Please sign-off your commit.

https://docs.pi-hole.net/guides/github/how-to-signoff/#how-to-amend-a-sign-off

@PeterDaveHello
Update Python dependency - urllib3 from v1.25.8 to v1.25.9
a6d0e49 
https://www.cve.org/CVERecord?id=CVE-2020-26137

> urllib3 before 1.25.9 allows CRLF injection if the attacker controls
> the HTTP request method, as demonstrated by inserting CR and LF
> control characters in the first argument of putrequest(). NOTE: this
> is similar to CVE-2020-26116.

Signed-off-by: Peter Dave Hello <hsu@peterdavehello.org>
@sonarcloud
Copy link

sonarcloud bot commented Jun 30, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@PeterDaveHello
Copy link
Contributor Author

Sure, it's done ;)

@PromoFaux PromoFaux merged commit b1c2555 into pi-hole:dev Jul 3, 2022
@PeterDaveHello PeterDaveHello deleted the update-python-dependency branch July 5, 2022 17:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@PeterDaveHello @yubiuser @PromoFaux