gitlab-cng-fips-18.4
Chainguard
Status
Impact
The urllib3 dependency at version 1.26.20 contains a vulnerability that is fixed in 2.6.0. This is a transitive dependency brought in by awscli<2 through botocore and cannot be directly overridden (urllib3<1.27,>=1.25.4 from botocore==1.40.28->awscli<2). Resolution requires upstream AWS CLI/Botocore to update urllib3 to version 2.6.0+.
Status