[Aikido] Fix 2 critical issues in pyyaml and 12 other issues

[aikido-autofix]

Upgrade PyYAML, urllib3, and requests to fix critical RCE vulnerabilities in YAML deserialization and high-severity DoS/SSL verification issues. This update includes breaking changes that require manual migration.

⚠️ Incomplete breaking changes analysis (2/3 analyzed)

⚠️ Breaking changes analysis not available for: pyyaml

⚠️ ## urllib3 Breaking Changes

1. requests.packages.urllib3 Access Pattern (urllib3 2.0.0 + requests 2.16.0)

Where your code is affected:

• elastalert/alerts.py lines ~2850 and ~3450 (HipChatAlerter and StrideAlerter classes)

Impact:

The code uses requests.packages.urllib3.disable_warnings() to suppress SSL warnings. Since requests 2.16.0 unvendored urllib3, requests.packages.urllib3 no longer exists and will raise an AttributeError.

Remediation:

Replace requests.packages.urllib3.disable_warnings() with direct urllib3 import: import urllib3; urllib3.disable_warnings().

Python Version Compatibility Issues

2. Python 2.7 Support Dropped (urllib3 2.0.0 + requests 2.28.0)

Where your code is affected:

• setup.py line 17 declares Python 2.7 support

• Multiple files throughout the codebase use Python 2-only syntax

Impact:

The codebase is written for Python 2.7 (uses basestring, unicode(), .iteritems(), HTMLParser from Python 2 location, etc.). Both urllib3 2.0.0+ and requests 2.28.0+ dropped Python 2.7 support entirely. The packages will fail to install or run on Python 2.7.

Remediation:

Either maintain urllib3 < 2.0.0 and requests < 2.28.0, or migrate the entire codebase to Python 3 (requires updating all Python 2 syntax including basestring, unicode, iteritems, HTMLParser imports, etc.).

3. Python 3.5 and 3.6 Support Dropped (urllib3 2.0.0 + requests 2.26.0/2.28.0)

Where your code is affected:

• Affects runtime environment if using Python 3.5 or 3.6

Impact:

If running on Python 3.5 or 3.6, the upgraded packages will not be compatible.

Remediation:

Upgrade to Python 3.7+ if migrating away from Python 2.7.

All breaking changes by upgrading urllib3 from version 1.23 to 2.7.0 (CHANGELOG)

Version	Description
1.24.0	Drop support for EOL Python 2.6
1.25.0	Require and validate certificates by default when using HTTPS
1.25.0	Upgraded urllib3.utils.parse_url() to be RFC 3986 compliant
1.25.0	Switched the default multipart header encoder from RFC 2231 to HTML 5 working draft
2.0.0	Removed support for Python 2.7, 3.5, and 3.6
2.0.0	Removed fallback on certificate commonName in match_hostname() function
2.0.0	Removed support for Python with an ssl module compiled with LibreSSL, CiscoSSL, wolfSSL, and all other OpenSSL alternatives
2.0.0	Removed support for OpenSSL versions earlier than 1.1.1 or that don't have SNI support
2.0.0	Removed the list of default ciphers for OpenSSL 1.1.1+ and SecureTransport
2.0.0	Removed urllib3.contrib.appengine.AppEngineManager and support for Google App Engine Standard Environment
2.0.0	Removed deprecated Retry options method_whitelist, DEFAULT_REDIRECT_HEADERS_BLACKLIST
2.0.0	Removed urllib3.HTTPResponse.from_httplib
2.0.0	Removed default value of None for the request_context parameter of urllib3.PoolManager.connection_from_pool_key
2.0.0	Removed the urllib3.request module
2.0.0	Removed support for SSLv3.0 from the urllib3.contrib.pyopenssl
2.0.0	Removed the deprecated urllib3.contrib.ntlmpool module
2.0.0	Removed DEFAULT_CIPHERS, HAS_SNI, USE_DEFAULT_SSLCONTEXT_CIPHERS from urllib3.util.ssl_
2.0.0	Removed urllib3.exceptions.SNIMissingWarning
2.0.0	Removed the _prepare_conn method from HTTPConnectionPool
2.0.0	Removed tls_in_tls_required property from HTTPSConnection
2.0.0	Removed the strict parameter/attribute from HTTPConnection, HTTPSConnection, HTTPConnectionPool, HTTPSConnectionPool, and HTTPResponse
2.0.0	Changed urllib3.response.HTTPResponse.read to respect the semantics of io.BufferedIOBase regardless of compression
2.0.0	Changed urllib3.HTTPConnection.getresponse to return an instance of urllib3.HTTPResponse instead of http.client.HTTPResponse
2.0.0	Changed default SSLContext.minimum_version to be TLSVersion.TLSv1_2
2.0.0	Changed urllib3.util.create_urllib3_context to not override the system cipher suites with a default value
2.0.0	Changed multipart/form-data header parameter formatting matches the WHATWG HTML Standard
2.0.0	Changed the error raised when connecting via HTTPS when the ssl module isn't available from SSLError to ImportError
2.0.0	Changed enforce_content_length default to True
2.0.0	Changed all parameters in the HTTPConnection and HTTPSConnection constructors to be keyword-only except host and port
2.1.0	Removed support for the deprecated urllib3[secure] extra
2.1.0	Removed support for the deprecated SecureTransport TLS implementation
2.1.0	Removed support for the end-of-life Python 3.7
2.3.0	Removed support for Python 3.8
2.6.0	Removed the HTTPResponse.getheaders() method in favor of HTTPResponse.headers
2.6.0	Removed the HTTPResponse.getheader(name, default) method in favor of HTTPResponse.headers.get(name, default)
2.6.0	The number of allowed chained encodings is now limited to 5

All breaking changes by upgrading requests from version 2.0.0 to 2.34.0 (CHANGELOG)

Version	Description
2.2.0	New exception: ContentDecodingError. Raised instead of urllib3 DecodeError exceptions.
2.3.0	The timeout parameter now affects requests with both stream=True and stream=False equally.
2.3.0	No longer expose Authorization or Proxy-Authorization headers on redirect. Fix CVE-2014-1829 and CVE-2014-1830 respectively.
2.5.0	Restrict requests to HTTP/1.1 and HTTP/1.0 (stop accepting HTTP/0.9)
2.6.0	CVE-2015-2296: Fix handling of cookies on redirect. Previously a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing.
2.8.0	The json parameter to post() and friends will now only be used if neither data nor files are present, consistent with the documentation.
2.11.0	Reject header values that contain leading whitespace or newline characters to reduce risk of header smuggling.
2.11.0	Fixed issue where responses whose body had not been fully consumed would have the underlying connection closed but not returned to the connection pool, which could cause Requests to hang in situations where the HTTPAdapter had been configured to use a blocking connection pool.
2.11.0	Some previous releases accidentally accepted non-strings as acceptable header values. This release does not.
2.11.0	Added type checks to ensure that iter_content only accepts integers and None for chunk sizes.
2.11.0	Fixed occasional TypeError when attempting to decode a JSON response that occurred in an error case. Now correctly returns a ValueError.
2.14.0	When users provide invalid paths to certificate bundle files or directories Requests now raises IOError, rather than failing at the time of the HTTPS request with a fairly inscrutable certificate validation error.
2.14.0	Restricted HTTPDigestAuth to only respond to auth challenges made on 4XX responses, rather than to all auth challenges.
2.16.0	Unvendor ALL the things!
2.20.0	Requests removes Authorization header from requests redirected from https to http on the same hostname. (CVE-2018-18074)
2.20.0	Requests has officially stopped support for Python 2.6.
2.22.0	Requests has officially stopped support for Python 3.4.
2.24.0	Redirect resolution should now only occur when allow_redirects is True.
2.25.0	Requests v2.25.x will be the last release series with support for Python 3.5.
2.25.0	The requests[security] extra is officially deprecated and will be removed in Requests v2.26.0.
2.26.0	Instead of chardet, use the MIT-licensed charset_normalizer for Python3 to remove license ambiguity for projects bundling requests.
2.26.0	Requests now supports idna 3.x on Python 3. idna 2.x will continue to be used on Python 2 installations.
2.26.0	Requests has officially dropped support for Python 3.5.
2.28.0	Requests has officially dropped support for Python 2.7.
2.28.0	Requests has officially dropped support for Python 3.6 (including pypy3.6).
2.28.0	Fixed bug where setting CURL_CA_BUNDLE to an empty string would disable cert verification. All Requests 2.x versions before 2.28.0 are affected.
2.30.0	Added support for urllib3 2.0. This may contain minor breaking changes so we advise careful testing and reviewing https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html prior to upgrading.
2.31.0	Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential forwarding of Proxy-Authorization headers to destination servers when following HTTPS redirects.
2.32.0	Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify.
2.32.0	Requests has officially dropped support for CPython 3.7.
2.32.0	Requests has officially dropped support for PyPy 3.7 and 3.8.
2.33.0	CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.
2.33.0	Dropped support for Python 3.9 following its end of support.
2.34.0	Requests 2.34.0 introduces inline types, replacing those provided by typeshed.
2.34.0	Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057.

✅ 14 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2020-14343	🚨 CRITICAL	[pyyaml] Arbitrary code execution vulnerability in YAML processing when handling untrusted input through full_load or FullLoader, allowing attackers to execute arbitrary code via malicious YAML constructs.
CVE-2017-18342	🚨 CRITICAL	[pyyaml] In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
CVE-2023-43804	HIGH	[urllib3] A vulnerability allows unintended cookie leakage via HTTP redirects to different origins when users specify a Cookie header without explicitly disabling redirects. This can lead to information disclosure as sensitive cookie data may be exposed to unintended recipients.
CVE-2019-11324	HIGH	[urllib3] SSL certificate verification can be bypassed when custom CA certificates are specified, allowing connections that should fail to succeed due to improper handling of certificate validation contexts.
CVE-2025-66471	HIGH	[urllib3] The Streaming API improperly handles highly compressed data, allowing attackers to cause excessive CPU usage and massive memory allocation through decompression of small compressed payloads. This results in a denial-of-service vulnerability via resource exhaustion.
CVE-2026-21441	HIGH	[urllib3] Decompression bomb vulnerability in streaming API for HTTP redirects. Malicious servers can trigger excessive resource consumption by sending compressed redirect responses that are fully decompressed without respecting read limits.
CVE-2020-26137	MEDIUM	[urllib3] before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
CVE-2024-37891	MEDIUM	[urllib3] The Proxy-Authorization header is not stripped during cross-origin redirects when set manually without using urllib3's proxy support, potentially leaking authentication credentials to malicious origins. This vulnerability requires manual header configuration, enabled redirects, and specific redirect conditions to be exploited.
CVE-2018-25091	MEDIUM	[urllib3] Authorization header is not removed when following cross-origin redirects, potentially exposing credentials to unintended hosts or transmitting them in cleartext.
CVE-2019-11236	MEDIUM	[urllib3] In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
CVE-2025-50181	MEDIUM	[urllib3] A vulnerability allows disabling redirects for all requests through improper PoolManager instantiation with retries configuration, potentially bypassing SSRF and open redirect mitigations. Applications relying on disabled redirects to prevent these vulnerabilities remain exposed to attacks.
CVE-2026-44431	MEDIUM	[urllib3] is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
CVE-2023-45803	MEDIUM	[urllib3] HTTP redirect responses (301, 302, 303) fail to remove request bodies when changing POST to GET, potentially leaking sensitive data to malicious redirect destinations. This information disclosure vulnerability requires a compromised trusted service to exploit.
AIKIDO-2026-106840	MEDIUM	[requests] Proxy bypass vulnerability in no_proxy matching logic allows attackers to bypass proxy-based egress controls by using lookalike domain names that match suffix patterns without respecting domain boundaries. This enables direct connections that circumvent SSRF protections and proxy-based security controls.

🔗 Related Tasks

• https://humansecurity.atlassian.net/browse/AIKIDO-2183
• https://humansecurity.atlassian.net/browse/AIKIDO-460
• https://humansecurity.atlassian.net/browse/AIKIDO-1260
• https://humansecurity.atlassian.net/browse/AIKIDO-347
• https://humansecurity.atlassian.net/browse/AIKIDO-1164