Skip to content

[maintenance] upgrade urllib3 and psutil #1366

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Mar 13, 2020

Conversation

pcrespov
Copy link
Member

@pcrespov pcrespov commented Mar 13, 2020

What do these changes do?

Upgrades urllib3 in all repo

image

and CVE-2019-18874

moderate severity
Vulnerable versions: <= 5.6.5
Patched version: 5.6.6
**psutil (aka python-psutil)** through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object

@pcrespov pcrespov changed the title Maintenance/upgrade urllib3 [maintenance] upgrade urllib3 Mar 13, 2020
@pcrespov pcrespov self-assigned this Mar 13, 2020
@codecov
Copy link

codecov bot commented Mar 13, 2020

Codecov Report

Merging #1366 into master will decrease coverage by 1.49%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff            @@
##           master    #1366     +/-   ##
=========================================
- Coverage   74.23%   72.73%   -1.5%     
=========================================
  Files         158      187     +29     
  Lines        6676     7545    +869     
  Branches      710      812    +102     
=========================================
+ Hits         4956     5488    +532     
- Misses       1506     1818    +312     
- Partials      214      239     +25
Flag Coverage Δ
#integrationtests 57.57% <ø> (+0.2%) ⬆️
#unittests 66.18% <ø> (-0.77%) ⬇️
Impacted Files Coverage Δ
...ges/service-library/src/servicelib/request_keys.py 0% <0%> (ø)
packages/service-library/src/servicelib/utils.py 66.66% <0%> (ø)
...ages/service-library/src/servicelib/aiopg_utils.py 91.39% <0%> (ø)
...kages/service-library/src/servicelib/rest_utils.py 65.71% <0%> (ø)
...s/service-library/src/servicelib/client_session.py 0% <0%> (ø)
...ges/service-library/src/servicelib/rest_routing.py 76.92% <0%> (ø)
...s/service-library/src/servicelib/requests_utils.py 0% <0%> (ø)
.../service-library/src/servicelib/openapi_servers.py 0% <0%> (ø)
packages/service-library/src/servicelib/tracing.py 0% <0%> (ø)
...s/service-library/src/servicelib/rest_responses.py 82.69% <0%> (ø)
... and 20 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d47b3f1...a622199. Read the comment docs.

@pcrespov pcrespov added dependencies t:maintenance Some planned maintenance work labels Mar 13, 2020
Pedro Crespo added 3 commits March 13, 2020 17:43
moderate severity
Vulnerable versions: <= 5.6.5
Patched version: 5.6.6
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

GHSA-qfc5-mcwq-26q8
@pcrespov pcrespov changed the title [maintenance] upgrade urllib3 [maintenance] upgrade urllib3 and psutil Mar 13, 2020
Copy link
Contributor

@ignapas ignapas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✔️

@pcrespov pcrespov merged commit 668028e into ITISFoundation:master Mar 13, 2020
@pcrespov pcrespov deleted the maintenance/upgrade-urllib3 branch March 13, 2020 18:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
t:maintenance Some planned maintenance work
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants