cancel_alert_via_api
4 years, 6 months ago
Test cancel request via API returns 404 if service id does not match
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Move validate_and_update_broadcast_message_status to a utils file
This is because that function is
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Move and update tests for updating broadcast message status
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 6 months ago
Merge pull request #3433 from alphagov/revert-parallel-status-180693991
Revert running status aggre
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
revert-parallel-status-180693991
4 years, 6 months ago
Revert running status aggregation in parallel
The top-level task didn't run successfully after this
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cryptography
4 years, 6 months ago
unpin cryptography
we previously pinned cryptography to versions less than 3.4 since after
that poi
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Move first test over to test_utils
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Move validate_and_update_broadcast_message_status to a utils file
This is because that function is
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Remove redundant parameters from a cancel broadcast via API test
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Extra assertions in rejecting broadcast via API test
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
update tests for non custom 404
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Remove unnecessary error handling
The context here should be enough for the users, custom error
mes
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Return 404 if reference from cancel message does not match
If the reference from cancel CAP XML we
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 6 months ago
Merge pull request #3428 from alphagov/remove-dup-column
Remove duplicate declaration for reference
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
master
4 years, 6 months ago
Merge pull request #3425 from alphagov/parallelise-ft-status-180693991
Parallelise status aggregati
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
Python 3 badge
URL
https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/alphagov/notifications-api/)
Restructured Text
.. image:: https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg
:target: https://pyup.io/repos/github/alphagov/notifications-api/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/alphagov/notifications-api/"><img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/alphagov/notifications-api/
RDoc
{<img src="https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/alphagov/notifications-api/]
pyup.io badge
URL
https://pyup.io/repos/github/alphagov/notifications-api/shield.svg
Markdown
[](https://pyup.io/repos/github/alphagov/notifications-api/)
Restructured Text
.. image:: https://pyup.io/repos/github/alphagov/notifications-api/shield.svg
:target: https://pyup.io/repos/github/alphagov/notifications-api/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/alphagov/notifications-api/"><img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/alphagov/notifications-api/shield.svg(Updates)!:https://pyup.io/repos/github/alphagov/notifications-api/
RDoc
{<img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/alphagov/notifications-api/]