search

IBM / ibm-cos-sdk-python-core

ibm-cos-sdk-python-core
Apache License 2.0
6 stars 14 forks source link

urllib3 2.1.0 flagging CVE-2024-37891 - can't resolve bc ibm-cos-sdk-core has a pin to <2.2 #27

Open bigpick opened 3 months ago

bigpick commented 3 months ago

Info

Remediation for CVE-2024-37891 is in urllib3 2.2.2 but can't upgrade to that bc this repo pins urllib3 to under 2.2:

ibm-cos-sdk-core 2.13.5 requires urllib3<2.2,>=1.26.18; python_version >= "3.10", but you have urllib3 2.2.2 which is incompatible.

(python3.11 fwiw)

IBMalok commented 2 months ago

@bigpick - I'm so sorry for the delay in getting back to you. We will be releasing the fix by next week.

IBMalok commented 2 months ago

@bigpick Delivered the fixes in 2.13.6. Please verify and close the ticket. Thanks