-
-
Notifications
You must be signed in to change notification settings - Fork 20
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Issue with urllib3 using requests 2.31.0 #19
Comments
Sure, done. Note though that the |
Thanks for resolving the issue so quickly! |
As an update, I think there might be another issue with urllib3 2.x with DEFAULT_CIPHERS being removed. Should the ssl module and ssl.create_default_context() be used to set the value? For example, something like the following in
Let me know what you think and if I should create a separate issue. Thanks! |
Ah, yes that will require an additional patch. Looks like it will need to be moved to a requests adapter. Feel free to create an new issue. |
Will do. Thanks! |
Thanks for all of your work on this project!
Since Requests v2.3.0, Requests has been vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuild_proxies is used to recompute and reattach the Proxy-Authorization header to requests when redirected. Note this behavior has only been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. https://username:password@proxy:8080).
Version 2.31.0 is now available to patch the issue.
As of requests 2.30.0, it appears that urllib3 2.x is required:
https://requests.readthedocs.io/en/latest/community/updates/
Using the current version that is specified as a dependency for whoisit causes a conflict.
Would it be possible to update the dependency?
Thanks!
Wes
The text was updated successfully, but these errors were encountered: