Potential Vulnerability in urllib3==1.25.11

[wangyueq0101]

Summary

A reachable construct was identified in urllib3==1.25.11 through my static analysis database. This version has been flagged as vulnerable in PyPI's open-source vulnerability database. The analysis uncovered more than 2 call chains leading to this construct. Below is one example to illustrate the potential vulnerability:

Call Chain Analysis

sync.main->requests.main->requests.sessions.main->requests.adapters.main->urllib3.contrib.socks.main->urllib3.util.url.main

(main means the body of the python file)

Patch and Code Changes

We suspect that this construct may be vulnerable because it was modified in a [security-related patch]. This suggests that the original code might have contained a flaw, and it may still be risky to use the affected version (urllib3==1.25.11) without further investigation.

Note:

This issue was identified through a static analysis of the project at commit [9bdfd6e].