Security audit: urllib3 CVE-2026-97687 and CVE-2026-97689 (fixed in 2.8.0), and four virtualenv advisories (fixed by 21.7.13) #324

New issue

Closed

opened 2026-09-30 15:26:22 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-09-30 15:26:22 +00:00

Owner

The Security audit failed on acb4372bc (run 604) on two advisories published against the locked urllib3 2.7.0. The push did not cause them.

Advisory	What it is	Fixed in
CVE-2026-97689 (CVSS 8.9)	The streaming chunk parser buffers a chunk-size line until a newline or EOF with no bound, so a hostile server can make the client allocate without limit (`HTTPResponse.read_chunked()` and `stream()`).	2.8.0
CVE-2026-97687 (CVSS 7.6)	An HTTPS proxy connection can take the target server's TLS settings, `cert_reqs=CERT_NONE` included, so an attacker who can intercept the proxy connection can impersonate the proxy.	2.8.0

urllib3 comes in through requests, which django-allauth's social sign-in uses (it fetches the OpenID Connect provider's discovery document, keys and tokens), and through the browser suite's pytest-base-url. The first advisory is reachable in principle, from a hostile or compromised identity provider, but the operator chooses that provider.

Fix: uv lock --upgrade-package urllib3 takes 2.8.0 with nothing else moving. There is nothing to ignore this time.

Added on 2026-10-01, before the fix was pushed

Four more advisories were published against the locked virtualenv 21.7.8: PYSEC-2026-4011, 4012, 4013 and 4014, all fixed by 21.7.13. virtualenv is a development tool only, here through pre-commit, and is never in the image. The same commit takes 21.14.2.

The *Security audit* failed on `acb4372bc` (run 604) on two advisories published against the locked `urllib3` 2.7.0. The push did not cause them. | Advisory | What it is | Fixed in | | --- | --- | --- | | CVE-2026-97689 (CVSS 8.9) | The streaming chunk parser buffers a chunk-size line until a newline or EOF with no bound, so a hostile server can make the client allocate without limit (`HTTPResponse.read_chunked()` and `stream()`). | 2.8.0 | | CVE-2026-97687 (CVSS 7.6) | An HTTPS proxy connection can take the target server's TLS settings, `cert_reqs=CERT_NONE` included, so an attacker who can intercept the proxy connection can impersonate the proxy. | 2.8.0 | `urllib3` comes in through `requests`, which django-allauth's social sign-in uses (it fetches the OpenID Connect provider's discovery document, keys and tokens), and through the browser suite's `pytest-base-url`. The first advisory is reachable in principle, from a hostile or compromised identity provider, but the operator chooses that provider. **Fix:** `uv lock --upgrade-package urllib3` takes 2.8.0 with nothing else moving. There is nothing to ignore this time. ## Added on 2026-10-01, before the fix was pushed Four more advisories were published against the locked `virtualenv` 21.7.8: PYSEC-2026-4011, 4012, 4013 and 4014, all fixed by 21.7.13. `virtualenv` is a development tool only, here through `pre-commit`, and is never in the image. The same commit takes 21.14.2.

tiagoagueda added this to the 0.5.0 milestone

2026-09-30 15:26:22 +00:00

tiagoagueda added the

bug

security

labels

2026-09-30 15:26:22 +00:00

tiagoagueda changed title from ~~Security audit: urllib3 CVE-2026-97687 and CVE-2026-97689, fixed in 2.8.0~~ to Security audit: urllib3 CVE-2026-97687 and CVE-2026-97689 (fixed in 2.8.0), and four virtualenv advisories (fixed by 21.7.13)

2026-10-01 10:59:24 +00:00

tiagoagueda referenced this issue from a commit

2026-10-01 10:59:31 +00:00

Take urllib3 2.8.0 and virtualenv 21.14.2, for the advisories against them

tiagoagueda closed this issue

2026-10-01 10:59:31 +00:00