Safety CI > DLR-SC/prov2bigchaindb

pyup-pin-prov-2.0.2

2 months, 1 week ago

78e7c0b7

Pin prov to latest version 2.0.2

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.5

2 months, 3 weeks ago

bff6b584

Pin networkx to latest version 3.5

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.4.2

10 months ago

634417d0

Pin networkx to latest version 3.4.2

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.4.1

10 months, 1 week ago

e8d47fa7

Pin networkx to latest version 3.4.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.4

10 months, 1 week ago

cb132d18

Pin networkx to latest version 3.4

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.0.1

1 year, 2 months ago

6a499d80

Pin prov to latest version 2.0.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.3

1 year, 4 months ago

a52c67fb

Pin networkx to latest version 3.3

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.2.1

1 year, 9 months ago

b010ce73

Pin networkx to latest version 3.2.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.2

1 year, 10 months ago

45ca9d7b

Pin networkx to latest version 3.2

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.1

2 years, 4 months ago

322aad25

Pin networkx to latest version 3.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.0.0

4 years, 9 months ago

894461ad

Pin prov to latest version 2.0.0

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-bigchaindb-2.2.2

4 years, 10 months ago

7523bd53

Pin bigchaindb to latest version 2.2.2

bigchaindb-driver 0.4.1 has known security vulnerabilities.

Package	Installed	Affected	Info
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-bigchaindb-2.2.1

5 years, 4 months ago

5edd50a4

Pin bigchaindb to latest version 2.2.1

bigchaindb-driver 0.4.1 has known security vulnerabilities.

Package	Installed	Affected	Info
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-bigchaindb-2.1.0

5 years, 6 months ago

9e89fe51

Pin bigchaindb to latest version 2.1.0

bigchaindb-driver 0.4.1 has known security vulnerabilities.

Package	Installed	Affected	Info
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-2.4

5 years, 10 months ago

1ad178e8

Pin networkx to latest version 2.4

bigchaindb-driver 0.4.1 has known security vulnerabilities.

Package	Installed	Affected	Info
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.