Potential Vulnerability in urllib3==1.25.9

[wangyueq0101]

Summary

A reachable construct was identified in urllib3==1.25.9 through my static analysis database. This version has been flagged as vulnerable in PyPI's open-source vulnerability database. The analysis uncovered more than 1 call chain leading to this construct. Below is one example to illustrate the potential vulnerability:

Call Chain Analysis

zappa.cli.main->requests->requests.sessions.main->requests.adapters.main->urllib3.contrib.socks.main->urllib3.util.url.main

(main refers to the body of the Python file, and it is invoked through import statements)

Patch and Code Changes

We suspect that this construct may be vulnerable because it was modified in a [security-related patch]. This suggests that the original code might have contained a flaw, and it may still be risky to use the affected version (urllib3==1.25.9) without further investigation.

Note:

This issue was identified through a static analysis of the project at commit [5a11c17].