From 32784d1b83a97c22a881a8529f7e9a16dccae9ca Mon Sep 17 00:00:00 2001 From: Franck Nijhof Date: Thu, 4 Nov 2021 11:21:30 +0100 Subject: [PATCH] Constrain urllib3 to >=1.26.5 (#59043) --- homeassistant/package_constraints.txt | 4 ++-- script/gen_requirements_all.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/homeassistant/package_constraints.txt b/homeassistant/package_constraints.txt index 90e0a14dadc..20b6a257213 100644 --- a/homeassistant/package_constraints.txt +++ b/homeassistant/package_constraints.txt @@ -36,8 +36,8 @@ zeroconf==0.36.11 pycryptodome>=3.6.6 -# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324 -urllib3>=1.24.3 +# Constrain urllib3 to ensure we deal with CVE-2020-26137 and CVE-2021-33503 +urllib3>=1.26.5 # Constrain H11 to ensure we get a new enough version to support non-rfc line endings h11>=0.12.0 diff --git a/script/gen_requirements_all.py b/script/gen_requirements_all.py index 3d2ace4c240..3deec512b4f 100755 --- a/script/gen_requirements_all.py +++ b/script/gen_requirements_all.py @@ -63,8 +63,8 @@ CONSTRAINT_PATH = os.path.join( CONSTRAINT_BASE = """ pycryptodome>=3.6.6 -# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324 -urllib3>=1.24.3 +# Constrain urllib3 to ensure we deal with CVE-2020-26137 and CVE-2021-33503 +urllib3>=1.26.5 # Constrain H11 to ensure we get a new enough version to support non-rfc line endings h11>=0.12.0