[Security] Bump urllib3 from 2.0.7 to 2.2.2
Bumps urllib3 from 2.0.7 to 2.2.2. This update includes a security fix.
Vulnerabilities fixed
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects When using urllib3's proxy support with
ProxyManager
, theProxy-Authorization
header is only sent to the configured proxy, as expected.However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the
Proxy-Authorization
header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat theProxy-Authorization
HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the
Proxy-Authorization
header during cross-origin redirects to avoid the small chance that users are doing this on accident.Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the
Proxy-Authorization
header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach.Affected usages
We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:
- Setting the
Proxy-Authorization
header without using urllib3's built-in proxy support.- Not disabling HTTP redirects.
- Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin.
Remediation
- Using the
Proxy-Authorization
header with urllib3'sProxyManager
.- Disabling HTTP redirects using
redirects=False
when sending requests.
... (truncated)
Patched versions: 2.2.2 Affected versions: >= 2.0.0, < 2.2.2
Release notes
Sourced from urllib3's releases.
2.2.2
🚀 urllib3 is fundraising for HTTP/2 supporturllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
- Added the
Proxy-Authorization
header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set viaRetry.remove_headers_on_redirect
.- Allowed passing negative integers as
amt
to read methods ofhttp.client.HTTPResponse
as an alternative toNone
. (#3122)- Fixed return types representing copying actions to use
typing.Self
. (#3363)Full Changelog: https://github.com/urllib3/urllib3/compare/2.2.1...2.2.2
2.2.1
🚀 urllib3 is fundraising for HTTP/2 supporturllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
- Fixed issue where
InsecureRequestWarning
was emitted for HTTPS connections when using Emscripten. (#3331)- Fixed
HTTPConnectionPool.urlopen
to stop automatically casting non-proxy headers toHTTPHeaderDict
. This change was premature as it did not apply to proxy headers andHTTPHeaderDict
does not handle byte header values correctly yet. (#3343)- Changed
ProtocolError
toInvalidChunkLength
when response terminates before the chunk length is sent. (#2860)- Changed
ProtocolError
to be more verbose on incomplete reads with excess content. (#3261)2.2.0
🖥 ️ urllib3 now works in the browser
🎉 This release adds experimental support for using urllib3 in the browser with Pyodide!🎉 Thanks to Joe Marshall (
@joemarshall
) for contributing this feature. This change was possible thanks to work done in urllib3 v2.0 to detach our API fromhttp.client
. Please report all bugs to the urllib3 issue tracker.
🚀 urllib3 is fundraising for HTTP/2 supporturllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
- Added support for Emscripten and Pyodide, including streaming support in cross-origin isolated browser environments where threading is enabled. (#2951)
- Added support for
HTTPResponse.read1()
method. (#3186)- Added rudimentary support for HTTP/2. (#3284)
- Fixed issue where requests against urls with trailing dots were failing due to SSL errors when using proxy. (#2244)
- Fixed
HTTPConnection.proxy_is_verified
andHTTPSConnection.proxy_is_verified
to be always set to a boolean after connecting to a proxy. It could beNone
in some cases previously. (#3130)
... (truncated)
Changelog
Sourced from urllib3's changelog.
2.2.2 (2024-06-17)
- Added the
Proxy-Authorization
header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set viaRetry.remove_headers_on_redirect
.- Allowed passing negative integers as
amt
to read methods ofhttp.client.HTTPResponse
as an alternative toNone
. ([#3122](https://github.com/urllib3/urllib3/issues/3122) <https://github.com/urllib3/urllib3/issues/3122>
__)- Fixed return types representing copying actions to use
typing.Self
. ([#3363](https://github.com/urllib3/urllib3/issues/3363) <https://github.com/urllib3/urllib3/issues/3363>
__)2.2.1 (2024-02-16)
- Fixed issue where
InsecureRequestWarning
was emitted for HTTPS connections when using Emscripten. ([#3331](https://github.com/urllib3/urllib3/issues/3331) <https://github.com/urllib3/urllib3/issues/3331>
__)- Fixed
HTTPConnectionPool.urlopen
to stop automatically casting non-proxy headers toHTTPHeaderDict
. This change was premature as it did not apply to proxy headers andHTTPHeaderDict
does not handle byte header values correctly yet. ([#3343](https://github.com/urllib3/urllib3/issues/3343) <https://github.com/urllib3/urllib3/issues/3343>
__)- Changed
InvalidChunkLength
toProtocolError
when response terminates before the chunk length is sent. ([#2860](https://github.com/urllib3/urllib3/issues/2860) <https://github.com/urllib3/urllib3/issues/2860>
__)- Changed
ProtocolError
to be more verbose on incomplete reads with excess content. ([#3261](https://github.com/urllib3/urllib3/issues/3261) <https://github.com/urllib3/urllib3/issues/3261>
__)2.2.0 (2024-01-30)
- Added support for
Emscripten and Pyodide <https://urllib3.readthedocs.io/en/latest/reference/contrib/emscripten.html>
, including streaming support in cross-origin isolated browser environments where threading is enabled. ([#2951](https://github.com/urllib3/urllib3/issues/2951) <https://github.com/urllib3/urllib3/issues/2951>
)- Added support for
HTTPResponse.read1()
method. ([#3186](https://github.com/urllib3/urllib3/issues/3186) <https://github.com/urllib3/urllib3/issues/3186>
__)- Added rudimentary support for HTTP/2. (
[#3284](https://github.com/urllib3/urllib3/issues/3284) <https://github.com/urllib3/urllib3/issues/3284>
__)- Fixed issue where requests against urls with trailing dots were failing due to SSL errors when using proxy. (
[#2244](https://github.com/urllib3/urllib3/issues/2244) <https://github.com/urllib3/urllib3/issues/2244>
__)- Fixed
HTTPConnection.proxy_is_verified
andHTTPSConnection.proxy_is_verified
to be always set to a boolean after connecting to a proxy. It could beNone
in some cases previously. ([#3130](https://github.com/urllib3/urllib3/issues/3130) <https://github.com/urllib3/urllib3/issues/3130>
__)- Fixed an issue where
headers
passed in a request withjson=
would be mutated ([#3203](https://github.com/urllib3/urllib3/issues/3203) <https://github.com/urllib3/urllib3/issues/3203>
__)- Fixed
HTTPSConnection.is_verified
to be set toFalse
when connecting from a HTTPS proxy to an HTTP target. It was set toTrue
previously. ([#3267](https://github.com/urllib3/urllib3/issues/3267) <https://github.com/urllib3/urllib3/issues/3267>
__)- Fixed handling of new error message from OpenSSL 3.2.0 when configuring an HTTP proxy as HTTPS (
[#3268](https://github.com/urllib3/urllib3/issues/3268) <https://github.com/urllib3/urllib3/issues/3268>
__)- Fixed TLS 1.3 post-handshake auth when the server certificate validation is disabled (
[#3325](https://github.com/urllib3/urllib3/issues/3325) <https://github.com/urllib3/urllib3/issues/3325>
__)- Note for downstream distributors: To run integration tests, you now need to run the tests a second time with the
--integration
pytest flag. ([#3181](https://github.com/urllib3/urllib3/issues/3181) <https://github.com/urllib3/urllib3/issues/3181>
__)2.1.0 (2023-11-13)
- Removed support for the deprecated urllib3[secure] extra. (
[#2680](https://github.com/urllib3/urllib3/issues/2680) <https://github.com/urllib3/urllib3/issues/2680>
__)- Removed support for the deprecated SecureTransport TLS implementation. (
[#2681](https://github.com/urllib3/urllib3/issues/2681) <https://github.com/urllib3/urllib3/issues/2681>
__)- Removed support for the end-of-life Python 3.7. (
[#3143](https://github.com/urllib3/urllib3/issues/3143) <https://github.com/urllib3/urllib3/issues/3143>
__)- Allowed loading CA certificates from memory for proxies. (
[#3065](https://github.com/urllib3/urllib3/issues/3065) <https://github.com/urllib3/urllib3/issues/3065>
__)- Fixed decoding Gzip-encoded responses which specified
x-gzip
content-encoding. ([#3174](https://github.com/urllib3/urllib3/issues/3174) <https://github.com/urllib3/urllib3/issues/3174>
__)
Commits
-
27e2a5c
Release 2.2.2 (#3406) -
accff72
Merge pull request from GHSA-34jh-p97f-mpxf -
34be4a5
Pin CFFI to a new release candidate instead of a Git commit (#3398) -
da41058
Bump browser-actions/setup-chrome from 1.6.0 to 1.7.1 (#3399) -
b07a669
Bump github/codeql-action from 2.13.4 to 3.25.6 (#3396) -
b8589ec
Measure coverage with v4 of artifact actions (#3394) -
f3bdc55
Allow triggering CI manually (#3391) -
5239265
Fix HTTP version in debug log (#3316) -
b34619f
Bump actions/checkout to 4.1.4 (#3387) -
9961d14
Bump browser-actions/setup-chrome from 1.5.0 to 1.6.0 (#3386) - Additional commits viewable in compare view