Safety CI > DLR-SC/prov2bigchaindb

pyup-pin-prov-2.5.1

14 hours ago

5af40c82

Pin prov to latest version 2.5.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.5.0

1 day, 8 hours ago

8f3d5688

Pin prov to latest version 2.5.0

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.4.0

1 week ago

58c6b4a3

Pin prov to latest version 2.4.0

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.3.0

1 week, 1 day ago

50dc5cec

Pin prov to latest version 2.3.0

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.2.0

1 week, 3 days ago

e9b27fd7

Pin prov to latest version 2.2.0

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.6.1

7 months, 1 week ago

3d2567d7

Pin networkx to latest version 3.6.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.1.1

7 months, 3 weeks ago

60af5b58

Pin prov to latest version 2.1.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.6

7 months, 3 weeks ago

4ff40b75

Pin networkx to latest version 3.6

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.0.2

1 year, 1 month ago

78e7c0b7

Pin prov to latest version 2.0.2

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.5

1 year, 1 month ago

bff6b584

Pin networkx to latest version 3.5

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.4.2

1 year, 8 months ago

634417d0

Pin networkx to latest version 3.4.2

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.4.1

1 year, 9 months ago

e8d47fa7

Pin networkx to latest version 3.4.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.4

1 year, 9 months ago

cb132d18

Pin networkx to latest version 3.4

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-prov-2.0.1

2 years, 1 month ago

6a499d80

Pin prov to latest version 2.0.1

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

pyup-pin-networkx-3.3

2 years, 3 months ago

a52c67fb

Pin networkx to latest version 3.3

BigchainDB 1.3.0 and bigchaindb-driver 0.4.1 have known security vulnerabilities.

Package	Installed	Affected	Info
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.
BigchainDB	1.3.0	<2.2.2	show Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.
bigchaindb-driver	0.4.1	<0.5.2	show Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'gunicorn' to v20.0.4 to include a security fix.

BigchainDB

1.3.0

<2.2.2

show

Bigchaindb 2.2.2 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.

bigchaindb-driver

0.4.1

<0.5.2

show

Bigchaindb-driver 0.5.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.