fix-status-task-logs-180693991
4 years, 5 months ago
Fix task name and action in status task logs
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
upsert-status-180693991
4 years, 5 months ago
Update FactStatus table in bulk for each service
Previously we were looping over data from the Noti
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
upsert-status-180693991
4 years, 5 months ago
Update FactStatus table in bulk for each service
Previously we were looping over data from the Noti
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
upsert-status-180693991
4 years, 5 months ago
Update FactStatus table in bulk for each service
Previously we were looping over data from the Noti
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
more-cap-acceptance
4 years, 5 months ago
Allow cancel of alert via API with no description
The XML for an alerts requires a `<description>`
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 5 months ago
Merge pull request #3457 from alphagov/bump-beat-memory
Bump memory for Celery Beat to 512M
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
bump-beat-memory
4 years, 5 months ago
Bump memory for Celery Beat to 512M
This fixes the app crashing - apparently due to a lack of free
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 5 months ago
Merge pull request #3456 from alphagov/error-if-cap-missing-references
Return 400 if references mis
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
search-index-180916673
4 years, 5 months ago
Temporary commit to get tests passing
Superseded by https://github.com/alphagov/notifications-aws/p
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
error-if-cap-missing-references
4 years, 5 months ago
Return 400 if references missing from cancel broadcast
If someone tries to cancel a broadcast but t
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
search-index-180916673
4 years, 5 months ago
Add GIN index to improve search performance
This should cut search times from minutes to millisecon
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 5 months ago
Merge pull request #3437 from alphagov/retry-parallel-status-180693991
Attempt 2 of parallelising s
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 5 months ago
Merge pull request #3448 from alphagov/drop_api_key_id_column_from_broadcast_message_table
Drop api
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 5 months ago
Merge pull request #3452 from alphagov/revert-3449-revert-3440-audit-api-key-id-when-cancelling-broa
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
drop_api_key_id_column_from_broadcast_message_table
4 years, 5 months ago
Drop api_key_id column from broadcast_message table
This column has been superseded by a new column
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
Python 3 badge
URL
https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/alphagov/notifications-api/)
Restructured Text
.. image:: https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg
:target: https://pyup.io/repos/github/alphagov/notifications-api/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/alphagov/notifications-api/"><img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/alphagov/notifications-api/
RDoc
{<img src="https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/alphagov/notifications-api/]
pyup.io badge
URL
https://pyup.io/repos/github/alphagov/notifications-api/shield.svg
Markdown
[](https://pyup.io/repos/github/alphagov/notifications-api/)
Restructured Text
.. image:: https://pyup.io/repos/github/alphagov/notifications-api/shield.svg
:target: https://pyup.io/repos/github/alphagov/notifications-api/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/alphagov/notifications-api/"><img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/alphagov/notifications-api/shield.svg(Updates)!:https://pyup.io/repos/github/alphagov/notifications-api/
RDoc
{<img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/alphagov/notifications-api/]