[Security] Bump urllib3 from 2.2.0 to 2.2.2
Bumps urllib3 from 2.2.0 to 2.2.2. This update includes a security fix.
Vulnerabilities fixed
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects When using urllib3's proxy support with
ProxyManager
, theProxy-Authorization
header is only sent to the configured proxy, as expected.However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the
Proxy-Authorization
header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat theProxy-Authorization
HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the
Proxy-Authorization
header during cross-origin redirects to avoid the small chance that users are doing this on accident.Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the
Proxy-Authorization
header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach.Affected usages
We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:
- Setting the
Proxy-Authorization
header without using urllib3's built-in proxy support.- Not disabling HTTP redirects.
- Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin.
Remediation
- Using the
Proxy-Authorization
header with urllib3'sProxyManager
.- Disabling HTTP redirects using
redirects=False
when sending requests.
... (truncated)
Patched versions: 2.2.2 Affected versions: >= 2.0.0, < 2.2.2
Release notes
Sourced from urllib3's releases.
2.2.2
🚀 urllib3 is fundraising for HTTP/2 supporturllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
- Added the
Proxy-Authorization
header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set viaRetry.remove_headers_on_redirect
.- Allowed passing negative integers as
amt
to read methods ofhttp.client.HTTPResponse
as an alternative toNone
. (#3122)- Fixed return types representing copying actions to use
typing.Self
. (#3363)Full Changelog: https://github.com/urllib3/urllib3/compare/2.2.1...2.2.2
2.2.1
🚀 urllib3 is fundraising for HTTP/2 supporturllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
- Fixed issue where
InsecureRequestWarning
was emitted for HTTPS connections when using Emscripten. (#3331)- Fixed
HTTPConnectionPool.urlopen
to stop automatically casting non-proxy headers toHTTPHeaderDict
. This change was premature as it did not apply to proxy headers andHTTPHeaderDict
does not handle byte header values correctly yet. (#3343)- Changed
ProtocolError
toInvalidChunkLength
when response terminates before the chunk length is sent. (#2860)- Changed
ProtocolError
to be more verbose on incomplete reads with excess content. (#3261)
Changelog
Sourced from urllib3's changelog.
2.2.2 (2024-06-17)
- Added the
Proxy-Authorization
header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set viaRetry.remove_headers_on_redirect
.- Allowed passing negative integers as
amt
to read methods ofhttp.client.HTTPResponse
as an alternative toNone
. ([#3122](https://github.com/urllib3/urllib3/issues/3122) <https://github.com/urllib3/urllib3/issues/3122>
__)- Fixed return types representing copying actions to use
typing.Self
. ([#3363](https://github.com/urllib3/urllib3/issues/3363) <https://github.com/urllib3/urllib3/issues/3363>
__)2.2.1 (2024-02-16)
- Fixed issue where
InsecureRequestWarning
was emitted for HTTPS connections when using Emscripten. ([#3331](https://github.com/urllib3/urllib3/issues/3331) <https://github.com/urllib3/urllib3/issues/3331>
__)- Fixed
HTTPConnectionPool.urlopen
to stop automatically casting non-proxy headers toHTTPHeaderDict
. This change was premature as it did not apply to proxy headers andHTTPHeaderDict
does not handle byte header values correctly yet. ([#3343](https://github.com/urllib3/urllib3/issues/3343) <https://github.com/urllib3/urllib3/issues/3343>
__)- Changed
InvalidChunkLength
toProtocolError
when response terminates before the chunk length is sent. ([#2860](https://github.com/urllib3/urllib3/issues/2860) <https://github.com/urllib3/urllib3/issues/2860>
__)- Changed
ProtocolError
to be more verbose on incomplete reads with excess content. ([#3261](https://github.com/urllib3/urllib3/issues/3261) <https://github.com/urllib3/urllib3/issues/3261>
__)
Commits
-
27e2a5c
Release 2.2.2 (#3406) -
accff72
Merge pull request from GHSA-34jh-p97f-mpxf -
34be4a5
Pin CFFI to a new release candidate instead of a Git commit (#3398) -
da41058
Bump browser-actions/setup-chrome from 1.6.0 to 1.7.1 (#3399) -
b07a669
Bump github/codeql-action from 2.13.4 to 3.25.6 (#3396) -
b8589ec
Measure coverage with v4 of artifact actions (#3394) -
f3bdc55
Allow triggering CI manually (#3391) -
5239265
Fix HTTP version in debug log (#3316) -
b34619f
Bump actions/checkout to 4.1.4 (#3387) -
9961d14
Bump browser-actions/setup-chrome from 1.5.0 to 1.6.0 (#3386) - Additional commits viewable in compare view