Skip to content

fix(oracle-kms): upgrade urllib3 to 2.7.0 to fix CVE-2026-44431 (KSM-1022) #1069

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
stas-schaller wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

fix(oracle-kms): upgrade urllib3 to 2.7.0 to fix CVE-2026-44431 (KSM-1022) #1069

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
943cccc
fix(oracle-kms): upgrade urllib3 to 2.7.0 to fix CVE-2026-44431 (KSM-…
stas-schaller Jun 24, 2026
1d5f120
fix(oracle-kms): drop Python 3.9 from CI matrix to match requires-python
stas-schaller Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/publish.pypi.sdk.storage.oracle.kms.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
python-version: ["3.10", "3.11", "3.12", "3.13"]
defaults:
run:
working-directory: ./sdk/python/storage/keeper_secrets_manager_storage_oracle_kms
Expand Down Expand Up @@ -182,10 +182,10 @@ jobs:
with:
persist-credentials: false

- name: Set up Python 3.9
- name: Set up Python 3.10
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.9'
python-version: '3.10'

- name: Install build tools
run: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test.python.storage.oracle.kms.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
python-version: ["3.10", "3.11", "3.12", "3.13"]
defaults:
run:
working-directory: ./sdk/python/storage/keeper_secrets_manager_storage_oracle_kms
Expand Down
9 changes: 9 additions & 0 deletions sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,15 @@ Once setup, the Secrets Manager Oracle KMS integration supports all Secrets Mana

## Change Log

### 1.1.1

**Requirements:**
- Minimum Python version raised to 3.10 (`urllib3>=2.7.0` requires Python 3.10+); users on Python 3.9 should pin to `<1.1.1`
- `oci` Python 3.9 split constraint removed; minimum is now `oci>=2.174.0` unconditionally

**Security:**
- **KSM-1022:** Fixed CVE-2026-44431; upgraded `urllib3` to 2.7.0. Versions before 2.7.0 forward `Authorization` and `Cookie` headers across origins when following redirects via the low-level `assert_same_host=False` code path (CVSS High)

### 1.1.0

**Requirements:**
Expand Down
12 changes: 3 additions & 9 deletions sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"

[project]
name = "keeper-secrets-manager-storage-oracle-kms"
version = "1.1.0"
version = "1.1.1"
description = "Keeper Secrets Manager SDK storage integration with Oracle Cloud KMS for encrypted key-value storage."
readme = "README.md"
requires-python = ">=3.9.2"
requires-python = ">=3.10"
license = {file = "LICENSE"}
authors = [
{name = "Keeper Security", email = "sm@keepersecurity.com"},
Expand All @@ -30,7 +30,6 @@ classifiers = [
"Operating System :: OS Independent",
"Programming Language :: Python",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.9",
"Programming Language :: Python :: 3.10",
"Programming Language :: Python :: 3.11",
"Programming Language :: Python :: 3.12",
Expand All @@ -40,12 +39,7 @@ classifiers = [
]
dependencies = [
"keeper-secrets-manager-core>=17.2.1",
# oci pins urllib3==1.26.x on Python 3.9 starting in 2.168.2, which conflicts
# with keeper-secrets-manager-core's urllib3>=2.6.3. On 3.10+, oci uses urllib3>=2.6.3
# so we can pull the latest. 2.167.3 is the oldest oci that allows cryptography>=46.0.5
# (needed for CVE-2026-26007); earlier oci versions cap cryptography<46.0.0.
"oci>=2.167.3,<2.168.2 ; python_version < '3.10'",
"oci>=2.174.0 ; python_version >= '3.10'",
"oci>=2.174.0",
"pycryptodome>=3.21.0",
"requests>=2.32.0",
"cryptography>=46.0.5",
Expand Down
12 changes: 4 additions & 8 deletions sdk/python/storage/keeper_secrets_manager_storage_oracle_kms/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# This file was autogenerated by uv via the following command:
# uv pip compile pyproject.toml --python-version 3.9 --universal -o requirements.txt
# uv pip compile pyproject.toml --python-version 3.10 --universal -o requirements.txt
certifi==2025.1.31
# via
# oci
Expand All @@ -20,17 +20,13 @@ idna==3.10
# via requests
keeper-secrets-manager-core==17.2.1
# via keeper-secrets-manager-storage-oracle-kms (pyproject.toml)
oci==2.168.1 ; python_full_version < '3.10'
# via keeper-secrets-manager-storage-oracle-kms (pyproject.toml)
oci==2.174.0 ; python_full_version >= '3.10'
oci==2.174.0
# via keeper-secrets-manager-storage-oracle-kms (pyproject.toml)
pycparser==2.22 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy'
# via cffi
pycryptodome==3.21.0
# via keeper-secrets-manager-storage-oracle-kms (pyproject.toml)
pyopenssl==25.3.0 ; python_full_version < '3.10'
# via oci
pyopenssl==26.2.0 ; python_full_version >= '3.10'
pyopenssl==26.2.0
# via oci
python-dateutil==2.9.0.post0
# via oci
Expand All @@ -46,7 +42,7 @@ typing-extensions==4.15.0 ; python_full_version < '3.13'
# via
# cryptography
# pyopenssl
urllib3==2.6.3
urllib3==2.7.0
# via
# keeper-secrets-manager-core
# oci
Expand Down
Loading