From fdd0becd5f79dbe46f930d2ff60414241754651b Mon Sep 17 00:00:00 2001 From: Franck Nijhof Date: Thu, 20 Feb 2020 19:19:09 +0100 Subject: [PATCH] Add minimal version contrain to urllib3 (#32031) --- homeassistant/package_constraints.txt | 3 +++ script/gen_requirements_all.py | 3 +++ 2 files changed, 6 insertions(+) diff --git a/homeassistant/package_constraints.txt b/homeassistant/package_constraints.txt index 1cfc92a6aab..396e1391d4e 100644 --- a/homeassistant/package_constraints.txt +++ b/homeassistant/package_constraints.txt @@ -28,6 +28,9 @@ zeroconf==0.24.4 pycryptodome>=3.6.6 +# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324 +urllib3>=1.24.3 + # Not needed for our supported Python versions enum34==1000000000.0.0 diff --git a/script/gen_requirements_all.py b/script/gen_requirements_all.py index 1bf9031a536..c4a94f99b18 100755 --- a/script/gen_requirements_all.py +++ b/script/gen_requirements_all.py @@ -58,6 +58,9 @@ CONSTRAINT_PATH = os.path.join( CONSTRAINT_BASE = """ pycryptodome>=3.6.6 +# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324 +urllib3>=1.24.3 + # Not needed for our supported Python versions enum34==1000000000.0.0