Safety CI > aguiardafa/projeto-base-stack-django

pyup-scheduled-update-2024-09-23

1 year, 7 months ago

42bc2448

Update setuptools from 74.0.0 to 75.1.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-09-16

1 year, 7 months ago

5b6a8584

Update setuptools from 74.0.0 to 75.0.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-09-16

1 year, 7 months ago

a30a4bf9

Update django from 5.1 to 5.1.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-09-09

1 year, 7 months ago

7bb01ed4

Update setuptools from 74.0.0 to 74.1.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-09-09

1 year, 7 months ago

f9687761

Update django from 5.1 to 5.1.1

No dependencies with known security vulnerabilities.

main

1 year, 8 months ago

f7569d4e

Merge pull request #138 from aguiardafa/pyup-scheduled-update-2024-09-02 Scheduled weekly dependenc

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-09-02

1 year, 8 months ago

43e93dd2

Update setuptools from 73.0.1 to 74.0.0

No dependencies with known security vulnerabilities.

main

1 year, 8 months ago

0939c543

Merge pull request #137 from aguiardafa/pyup-scheduled-update-2024-08-26 Scheduled weekly dependenc

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-08-26

1 year, 8 months ago

ee7d9f20

Update typing-extensions from 4.11.0 to 4.12.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-08-26

1 year, 8 months ago

2e1de979

Update sqlparse from 0.5.0 to 0.5.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-08-26

1 year, 8 months ago

2d169bea

Update setuptools from 69.5.1 to 73.0.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-08-26

1 year, 8 months ago

c1fb90ce

Update pycodestyle from 2.11.1 to 2.12.1

setuptools 69.5.1 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	69.5.1	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	69.5.1	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

setuptools

69.5.1

<70.0.0

show

Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

setuptools

69.5.1

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

pyup-scheduled-update-2024-08-26

1 year, 8 months ago

73e70363

Update pillow from 10.3.0 to 10.4.0

setuptools 69.5.1 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	69.5.1	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	69.5.1	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

setuptools

69.5.1

<70.0.0

show

Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

setuptools

69.5.1

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

pyup-scheduled-update-2024-08-26

1 year, 8 months ago

d68a9afd

Update gunicorn from 22.0.0 to 23.0.0

setuptools 69.5.1 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	69.5.1	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	69.5.1	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

setuptools

69.5.1

<70.0.0

show

Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

setuptools

69.5.1

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

pyup-scheduled-update-2024-08-26

1 year, 8 months ago

e795732b

Update flake8 from 7.0.0 to 7.1.1

gunicorn 22.0.0 and setuptools 69.5.1 have known security vulnerabilities.

Package	Installed	Affected	Info
gunicorn	22.0.0	>=22.0.0,<23.0.0	show A vulnerability in Gunicorn allowed the TolerateDangerousFraming setting to process conflicting headers (Transfer-Encoding and Content-Length) and dangerous characters in HTTP header fields. This could lead to HTTP request smuggling and header injection attacks. The issue was resolved by removing this setting and enforcing stricter header validation. Note: It happens due to an incomplete fix for CVE-2024-1135.
setuptools	69.5.1	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	69.5.1	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

gunicorn

22.0.0

>=22.0.0,<23.0.0

show

A vulnerability in Gunicorn allowed the TolerateDangerousFraming setting to process conflicting headers (Transfer-Encoding and Content-Length) and dangerous characters in HTTP header fields. This could lead to HTTP request smuggling and header injection attacks. The issue was resolved by removing this setting and enforcing stricter header validation. 
Note: It happens due to an incomplete fix for CVE-2024-1135.

setuptools

69.5.1

<70.0.0

show

Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

setuptools

69.5.1

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.