Safety CI > agconti/cookiecutter-django-rest

pyup-scheduled-update-2023-02-28

3 years, 2 months ago

b18ffeda

Update ipython from 8.9.0 to 8.10.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-28

3 years, 2 months ago

812b3ffb

Update newrelic from 8.5.0 to 8.7.0

ipython 8.9.0 has known security vulnerabilities.

Package	Installed	Affected	Info
ipython	8.9.0	<8.10.0	show IPython 8.10.0 includes a fix for CVE-2023-24816: Versions prior to 8.10.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function 'IPython.utils.terminal.set_term_title' be called on Windows in a Python environment where ctypes is not available. The dependency on 'ctypes' in 'IPython.utils._process_win32' prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool 'set_term_title' could be called and hence introduce a vulnerability. If an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. As a workaround, users should ensure that any calls to the 'IPython.utils.terminal.set_term_title' function are done with trusted or filtered input. https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7

Package

Installed

Affected

Info

ipython

8.9.0

<8.10.0

show

IPython 8.10.0 includes a fix for CVE-2023-24816: Versions prior to 8.10.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function 'IPython.utils.terminal.set_term_title' be called on Windows in a Python environment where ctypes is not available. The dependency on 'ctypes' in 'IPython.utils._process_win32' prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool 'set_term_title' could be called and hence introduce a vulnerability. If an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. As a workaround, users should ensure that any calls to the 'IPython.utils.terminal.set_term_title' function are done with trusted or filtered input.
https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7

pyup-scheduled-update-2023-02-27

3 years, 2 months ago

bb8cd323

Update boto3 from 1.26.66 to 1.26.79

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-27

3 years, 2 months ago

403d4aab

Update coverage from 7.1.0 to 7.2.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-27

3 years, 2 months ago

0cfa905b

Update ipython from 8.9.0 to 8.10.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-27

3 years, 2 months ago

2e544102

Update newrelic from 8.5.0 to 8.7.0

ipython 8.9.0 has known security vulnerabilities.

Package	Installed	Affected	Info
ipython	8.9.0	<8.10.0	show IPython 8.10.0 includes a fix for CVE-2023-24816: Versions prior to 8.10.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function 'IPython.utils.terminal.set_term_title' be called on Windows in a Python environment where ctypes is not available. The dependency on 'ctypes' in 'IPython.utils._process_win32' prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool 'set_term_title' could be called and hence introduce a vulnerability. If an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. As a workaround, users should ensure that any calls to the 'IPython.utils.terminal.set_term_title' function are done with trusted or filtered input. https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7

Package

Installed

Affected

Info

ipython

8.9.0

<8.10.0

show

IPython 8.10.0 includes a fix for CVE-2023-24816: Versions prior to 8.10.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function 'IPython.utils.terminal.set_term_title' be called on Windows in a Python environment where ctypes is not available. The dependency on 'ctypes' in 'IPython.utils._process_win32' prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool 'set_term_title' could be called and hence introduce a vulnerability. If an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. As a workaround, users should ensure that any calls to the 'IPython.utils.terminal.set_term_title' function are done with trusted or filtered input.
https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7

pyup-scheduled-update-2023-02-26

3 years, 2 months ago

4bb1dc95

Update boto3 from 1.26.66 to 1.26.79

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-26

3 years, 2 months ago

afb47f58

Update coverage from 7.1.0 to 7.2.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-26

3 years, 2 months ago

90b98be9

Update ipython from 8.9.0 to 8.10.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-26

3 years, 2 months ago

d7a14fdc

Update newrelic from 8.5.0 to 8.7.0

ipython 8.9.0 has known security vulnerabilities.

Package	Installed	Affected	Info
ipython	8.9.0	<8.10.0	show IPython 8.10.0 includes a fix for CVE-2023-24816: Versions prior to 8.10.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function 'IPython.utils.terminal.set_term_title' be called on Windows in a Python environment where ctypes is not available. The dependency on 'ctypes' in 'IPython.utils._process_win32' prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool 'set_term_title' could be called and hence introduce a vulnerability. If an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. As a workaround, users should ensure that any calls to the 'IPython.utils.terminal.set_term_title' function are done with trusted or filtered input. https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7

Package

Installed

Affected

Info

ipython

8.9.0

<8.10.0

show

IPython 8.10.0 includes a fix for CVE-2023-24816: Versions prior to 8.10.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function 'IPython.utils.terminal.set_term_title' be called on Windows in a Python environment where ctypes is not available. The dependency on 'ctypes' in 'IPython.utils._process_win32' prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool 'set_term_title' could be called and hence introduce a vulnerability. If an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. As a workaround, users should ensure that any calls to the 'IPython.utils.terminal.set_term_title' function are done with trusted or filtered input.
https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7

pyup-scheduled-update-2023-02-25

3 years, 2 months ago

38db2892

Update boto3 from 1.26.66 to 1.26.79

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-25

3 years, 2 months ago

3d0b72d0

Update coverage from 7.1.0 to 7.2.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-25

3 years, 2 months ago

81824039

Update ipython from 8.9.0 to 8.10.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-02-25

3 years, 2 months ago

d810afa8

Update newrelic from 8.5.0 to 8.7.0

ipython 8.9.0 has known security vulnerabilities.

Package	Installed	Affected	Info
ipython	8.9.0	<8.10.0	show IPython 8.10.0 includes a fix for CVE-2023-24816: Versions prior to 8.10.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function 'IPython.utils.terminal.set_term_title' be called on Windows in a Python environment where ctypes is not available. The dependency on 'ctypes' in 'IPython.utils._process_win32' prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool 'set_term_title' could be called and hence introduce a vulnerability. If an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. As a workaround, users should ensure that any calls to the 'IPython.utils.terminal.set_term_title' function are done with trusted or filtered input. https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7

Package

Installed

Affected

Info

ipython

8.9.0

<8.10.0

show

IPython 8.10.0 includes a fix for CVE-2023-24816: Versions prior to 8.10.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function 'IPython.utils.terminal.set_term_title' be called on Windows in a Python environment where ctypes is not available. The dependency on 'ctypes' in 'IPython.utils._process_win32' prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool 'set_term_title' could be called and hence introduce a vulnerability. If an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. As a workaround, users should ensure that any calls to the 'IPython.utils.terminal.set_term_title' function are done with trusted or filtered input.
https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7

pyup-scheduled-update-2023-02-24

3 years, 2 months ago

96d9258b

Update boto3 from 1.26.66 to 1.26.78

No dependencies with known security vulnerabilities.