Open staging-whitesource-for-github-com[bot] opened 5 hours ago
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/40/4e/54411cb5f7c69782304a7ab27ba9d7d9a3908cd68b67f6502137342d0d9c/urllib3-1.17-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy: - :x: **urllib3-1.17-py2.py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: 744f3c3abf5275ba2321c7e55ca8a2753c38f241
Found in base branch: main
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
Publish Date: 2019-04-15
URL: CVE-2019-11236
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-r64q-w8jr-g9qp
Release Date: 2019-04-15
Fix Resolution: 1.24.3
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2019-11236 - Medium Severity Vulnerability
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/40/4e/54411cb5f7c69782304a7ab27ba9d7d9a3908cd68b67f6502137342d0d9c/urllib3-1.17-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy: - :x: **urllib3-1.17-py2.py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: 744f3c3abf5275ba2321c7e55ca8a2753c38f241
Found in base branch: main
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
Publish Date: 2019-04-15
URL: CVE-2019-11236
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-r64q-w8jr-g9qp
Release Date: 2019-04-15
Fix Resolution: 1.24.3
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.