search

anchore / anchore-cli

Simple command-line client to the Anchore Engine service
Apache License 2.0
114 stars 54 forks source link

Upgrade urllib3 version to 1.28.8+ to fix CVE-2020-7212 #58

Closed mleneveut closed 4 years ago

mleneveut commented 4 years ago

Is your feature request related to a problem? Please describe. Yes, the CVE-2020-7212 : https://nvd.nist.gov/vuln/detail/CVE-2020-7212

Describe the solution you'd like Upgrade the required dependency, which seems to be urllib3==1.25.7 currently.

Describe alternatives you've considered Upgrading manually the urllib3 with pip3 install --upgrade urllib3 brakes anchore-cli : 

pkg_resources.DistributionNotFound: The 'urllib3==1.25.7' distribution was not found and is required by anchorecli

Additional context

anchorecli (0.6.1)