Add minimal version contrain to urllib3 (#32031)

2020-02-20 19:19:09 +01:00 · 2020-02-20 19:19:09 +01:00 · fdd0becd5f
parent 425e6b2b1f
commit fdd0becd5f
2 changed files with 6 additions and 0 deletions
--- a/homeassistant/package_constraints.txt
+++ b/homeassistant/package_constraints.txt
@ -28,6 +28,9 @@ zeroconf==0.24.4

 pycryptodome>=3.6.6

+# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324
+urllib3>=1.24.3
+
 # Not needed for our supported Python versions
 enum34==1000000000.0.0

--- a/script/gen_requirements_all.py
+++ b/script/gen_requirements_all.py
@ -58,6 +58,9 @@ CONSTRAINT_PATH = os.path.join(
 CONSTRAINT_BASE = """
 pycryptodome>=3.6.6

+# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324
+urllib3>=1.24.3
+
 # Not needed for our supported Python versions
 enum34==1000000000.0.0