opensearch-project / opensearch-py

Python Client for OpenSearch
https://opensearch.org/docs/latest/clients/python/
Apache License 2.0
350 stars 175 forks source link

[CVE RISK] Upgrade urllib3 to v1.26.5 (for opensearch-benchmark #378) #515

Closed AkshathRaghav closed 1 year ago

AkshathRaghav commented 1 year ago

Description

An issue was discovered in urllib3 before 1.26.5: when provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Issues Resolved

This change increments the required urllib3 package in setup.py for that purpose.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check here.

codecov[bot] commented 1 year ago

Codecov Report

Merging #515 (d833b65) into main (c6c7df5) will not change coverage. Report is 1 commits behind head on main. The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #515   +/-   ##
=======================================
  Coverage   70.86%   70.86%           
=======================================
  Files          83       83           
  Lines        7796     7796           
=======================================
  Hits         5525     5525           
  Misses       2271     2271           
Files Coverage Δ
opensearchpy/_async/client/tasks.py 64.28% <ø> (ø)
opensearchpy/client/tasks.py 85.71% <ø> (ø)
dblock commented 1 year ago

Looks like this PR brought it another unintended change with client generation.

@AkshathRaghav you should work on branches, seeing that you work off main I think you'll need to rewind it without loosing your changes - this post may be helpful