CVE-2019-11324

Advisory

Python-jss 2.1.0 updates its dependency 'urllib3' to v1.24.2 to mitigate a vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added
- Retained compatibility with AutoPkg 1.x (Python 2) while adding compatibility for AutoPkg 2.x (Python 3).
- Added `$` to safe characters in URLs to allow hidden shares (169).

Changed
- Brought in latest upstream changes from [FoundationPlist](https://github.com/munki/munki/blob/72a0535/code/client/munkilib/FoundationPlist.py) and [GURL](https://github.com/munki/munki/blob/72a0535/code/client/munkilib/gurl.py).

Security
- `urllib3` dependency version bumped to mitigate vulnerability.

Resources

• https://pypi.org/project/python-jss
• https://pyup.io/changelogs/python-jss/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11324