[Snyk: High] CRLF injection found in urllib3 [due: 9/5/2019]

[jason-upchurch]

Summary

found in requirements-ci.txt:

High severity vulnerability found in urllib3
Description: CRLF injection
Info: https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-174323
Introduced through: codecov@2.0.9
From: codecov@2.0.9 > requests@2.21.0 > urllib3@1.24.1

High severity vulnerability found in urllib3
Description: Improper Certificate Validation
Info: https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-174464
Introduced through: codecov@2.0.9
From: codecov@2.0.9 > requests@2.21.0 > urllib3@1.24.1

Overview for CRLF injection

urllib3 is an HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to CRLF injection. Attacker who has the control of the requesting address parameter, could manipulate an HTTP header and attack an internal service.

Overview for Improper Certificate Validation

urllib3 is an HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Certificate Validation. It mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates. This can result in SSL connections succeeding in situations where it should have failed.

Remediation

Upgrade urllib3 to version 1.24.3 or higher.

[pkfec]

urllib3 CRLF injection vulnerability has been fixed in 1.24 series and released as 1.24.3.
see more:urllib3/urllib3#1553

Our development environment is already running on the latest release of urllib3 v1.24.3 package.
No need to make any changes. Closing this issue.