Safety CI > alphagov/notifications-api

remove-yesterdays-planned-tests-on-govuk-alerts

4 years, 9 months ago

dda93aaf

Republish gov.uk/alerts every night to clear down planned tests We have made it so that gov.uk/aler

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

billing-explanation

4 years, 9 months ago

9bd72d87

add explanation to ft_billing model i found myself constantly trying to work out what each column m

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

celery-extend-request-id-180213914

4 years, 9 months ago

ac065291

Enable request tracing on Celery success/fail logs Previously these logs wouldn't have a Request ID

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

celery-headers-request-id-180213914

4 years, 9 months ago

89a8dd1a

Move Celery task Request ID injection into headers Previously we passed along this piece of state v

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

enable-arg-checking-180213914

4 years, 9 months ago

254296e4

Reenable argument checking for Celery tasks Relates to: [1]. This is safe now that [2] has been de

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

celery-headers-request-id-180213914

4 years, 9 months ago

041ab016

Reenable argument checking for Celery tasks Relates to: [1]. This is safe now that we no longer fi

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

py39

4 years, 9 months ago

6018a18a

make pyup point at new files '(requirements-dev hasn'\''t existed for ages anyway)'