opened
tuck1s
username_0
Summary.

[CVE-2018-20060](https://nvd.nist.gov/vuln/detail/CVE-2018-20060) identifies a vulnerability in `urllib3` before version 1.23.
 
This project `Pipfile` --> `Pipfile.lock` is using version 1.22 currently: [here](https://github.com/requests/requests/blob/c452e3b92d65cb9b5377606488888da0da5db3ad/Pipfile.lock#L56)
Address CVE-2018-20060
issue
created
nateprewitt
username_1
Hi @username_0, we reviewed the urllib3 issue when it was disclosed. Requests doesn’t use urllib3’s redirect functionality and we’ve already patched a sinusale vulnerability in #4718.
comment
created
tuck1s
username_0
Good to know, thanks. This came to my attention because Github are sending out warning notices by email, like this, for transitive dependencies. I assume it's likely other folks will also get this warning.

_Known high severity security vulnerability detected in urllib3 < 1.23 defined in Pipfile.lock.
--
Pipfile.lock update suggested: urllib3 ~> 1.23._
comment
closed
sigmavirus24
username_2
issue