Package
py3-cassandra-medusa
Component
urllib3
Latest update
Fixed version
0.29.0-r2
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
0.29.0-r2Status
Impact
The detection points at the urllib3 manifest entry inside pip's _vendor/vendor.txt — a copy bundled by pip itself, not by the package's runtime urllib3. The vulnerable urllib3 streaming decompression code path is reachable only when pip's own networking is invoked, and bumping the runtime urllib3 cannot replace pip's frozen vendored copy. Tracking upstream pip for a release that revendors urllib3 >= 2.7.0.
Status