pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update iso8601 from 0.1.14 to 1.0.2
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update celery from 5.2.0 to 5.2.3
celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update iso8601 from 0.1.14 to 1.0.2
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update flask from 1.1.2 to 2.0.2
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update flask-migrate from 2.7.0 to 3.1.0
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update flask from 1.1.2 to 2.0.2
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update flask-migrate from 2.7.0 to 3.1.0
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update celery from 5.2.0 to 5.2.3
eventlet 0.30.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update cffi from 1.14.5 to 1.15.0
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
pyup-scheduled-update-2022-01-19
4 years, 6 months ago
Update cffi from 1.14.5 to 1.15.0
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
letters-too-long
4 years, 6 months ago
If there is an invalid letter that has not been updated to `validation-failed` because the `update-v
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
rename_billing_report_column_sms_fragments
4 years, 6 months ago
Rename sms_fragments to sms_chargeable_units
This field caused some confusion and lots of unnec
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
parallelise-ft-status-180693991
4 years, 6 months ago
Minor tweaks to address comments on the PR
To address:
- https://github.com/alphagov/notifications
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
letters-too-long
4 years, 6 months ago
Add new task to update notification to validation-failed, template-preview puts this new task on the
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
cancel_alert_via_api
4 years, 6 months ago
Return 404 if reference from cancel message does not match
If the reference from cancel CAP XML we
celery 5.2.0, celery 5.2.0 and eventlet 0.30.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| celery | 5.2.0 | <5.2.2 |
show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. |
| eventlet | 0.30.2 | <0.40.3 |
show Affected versions of the eventlet package are vulnerable to Request Smuggling due to improper handling of HTTP trailer sections. The eventlet.wsgi module’s _chunked_read method read only a single line after the terminating 0\r\n chunk and failed to consume remaining trailer lines, leaving bytes in the connection buffer that could be interpreted as the start of a subsequent request. |
| eventlet | 0.30.2 | <0.37.0 |
show Eventlet affected versions contain a vulnerability in HTTP header processing within the WSGI implementation. This flaw could allow attackers to craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment. Such manipulation could lead to security issues depending on how applications process these headers. |
| eventlet | 0.30.2 | <0.34.3 |
show Eventlet 0.34.3 addresses a security concern by adhering to RFC 9112 standards, now rejecting requests that include both content-length and transfer-encoding headers simultaneously, a practice that violates the RFC and could pose security risks. However, the reject_bad_request option, if disabled, allows these requests for compatibility with older servers that cannot be updated. https://github.com/eventlet/eventlet/pull/826/commits/3e50a26878ed08e6a7f510d8d3bc49cf7ee970ed |
| eventlet | 0.30.2 | <0.35.2 |
show Eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. |
| eventlet | 0.30.2 | <0.31.0 |
show Eventlet 0.31.0 includes a fix for CVE-2021-21419: A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. |
Python 3 badge
URL
https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/alphagov/notifications-api/)
Restructured Text
.. image:: https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg
:target: https://pyup.io/repos/github/alphagov/notifications-api/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/alphagov/notifications-api/"><img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/alphagov/notifications-api/
RDoc
{<img src="https://pyup.io/repos/github/alphagov/notifications-api/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/alphagov/notifications-api/]
pyup.io badge
URL
https://pyup.io/repos/github/alphagov/notifications-api/shield.svg
Markdown
[](https://pyup.io/repos/github/alphagov/notifications-api/)
Restructured Text
.. image:: https://pyup.io/repos/github/alphagov/notifications-api/shield.svg
:target: https://pyup.io/repos/github/alphagov/notifications-api/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/alphagov/notifications-api/"><img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/alphagov/notifications-api/shield.svg(Updates)!:https://pyup.io/repos/github/alphagov/notifications-api/
RDoc
{<img src="https://pyup.io/repos/github/alphagov/notifications-api/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/alphagov/notifications-api/]