pyup-scheduled-update-2022-02-02
4 years, 6 months ago
Update flask from 1.1.2 to 2.0.2
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-02-02
4 years, 6 months ago
Update flask-migrate from 2.7.0 to 3.1.0
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-02-02
4 years, 6 months ago
Update flask-migrate from 2.7.0 to 3.1.0
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-02-02
4 years, 6 months ago
Update celery from 5.2.0 to 5.2.3
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-02-02
4 years, 6 months ago
Update celery from 5.2.0 to 5.2.3
celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-02-02
4 years, 6 months ago
Update cffi from 1.14.5 to 1.15.0
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-02-02
4 years, 6 months ago
Update cffi from 1.14.5 to 1.15.0
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 6 months ago
Merge pull request #3430 from alphagov/rename_billing_report_column_sms_fragments
Rename sms_fragme
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 6 months ago
Merge pull request #3441 from alphagov/move-log-message
Moved log message inside the if statement w
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 6 months ago
Merge pull request #3418 from alphagov/letters-too-long
Mark letters as validation-failed if the te
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
celery-docker
4 years, 6 months ago
move environment variables to their own lines and set -eu
this means that if the environment variab
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
celery-docker
4 years, 6 months ago
move environment variables to their own lines and set -eu
this means that if the environment variab
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
celery-docker
4 years, 6 months ago
add script to run celery from within docker
as a team we primarily develop locally. However, we've
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
move-log-message
4 years, 6 months ago
Moved log message inside the if statement where it actually happens.
This caught me out the other da
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 6 months ago
Merge pull request #3427 from alphagov/remove-name-uniqueness-endpoints
Remove endpoints for checki
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
Python 3 badge
URL
https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/alphagov/notifications-api/)
Restructured Text
.. image:: https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg
:target: https://pyup.io/repos/github/alphagov/notifications-api/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/alphagov/notifications-api/"><img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/alphagov/notifications-api/
RDoc
{<img src="https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/alphagov/notifications-api/]
pyup.io badge
URL
https://pyup.io/repos/github/alphagov/notifications-api/shield.svg
Markdown
[](https://pyup.io/repos/github/alphagov/notifications-api/)
Restructured Text
.. image:: https://pyup.io/repos/github/alphagov/notifications-api/shield.svg
:target: https://pyup.io/repos/github/alphagov/notifications-api/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/alphagov/notifications-api/"><img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/alphagov/notifications-api/shield.svg(Updates)!:https://pyup.io/repos/github/alphagov/notifications-api/
RDoc
{<img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/alphagov/notifications-api/]