Safety CI > alphagov/notifications-api

pyup-scheduled-update-2021-11-10

4 years, 9 months ago

4847c218

Update psycopg2-binary from 2.8.6 to 2.9.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2021-11-10

4 years, 9 months ago

93a631b1

Update jsonschema from 3.2.0 to 4.2.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2021-11-10

4 years, 9 months ago

c76f6b67

Update itsdangerous from 1.1.0 to 2.0.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2021-11-10

4 years, 9 months ago

b3138046

Update iso8601 from 0.1.14 to 1.0.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2021-11-10

4 years, 9 months ago

ab012e24

Update flask from 1.1.2 to 2.0.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2021-11-10

4 years, 9 months ago

78b062d2

Update celery from 5.1.2 to 5.2.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2021-11-10

4 years, 9 months ago

de35bb3d

Update flask-migrate from 2.7.0 to 3.1.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2021-11-10

4 years, 9 months ago

3a8c4e5c

Update cffi from 1.14.5 to 1.15.0

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

master

4 years, 9 months ago

770d3232

Merge pull request #3341 from alphagov/rebuild-letters Add task to recreate the PDF file for a non-

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

celery-5.2.0

4 years, 9 months ago

c60f2c24

Bump Celery to latest version This brings in the version 5.2.1 of Kombu, which fixes a security vul

No dependencies with known security vulnerabilities.

rebuild-letters

4 years, 9 months ago

3cffba6d

Add command to run `recreate_pdf_for_precompiled_or_uploaded_letter` We already had the `replay-cre

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

master

4 years, 9 months ago

ff78ea32

Merge pull request #3360 from alphagov/test-limit-timeout-notifications Optimise query to get notif

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

test-limit-timeout-notifications

4 years, 9 months ago

cdb43fba

Only loop timeout task if there's more work Previously this would repeat the task even the current

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

test-limit-timeout-notifications

4 years, 9 months ago

77c8c0a5

Optimise query to get notifications to "time out" From experimenting in production we found a "!="

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

test-limit-timeout-notifications

4 years, 9 months ago

f66e5f7e

Optimise query to get notifications to "time out" From experimenting in production we found a "!="

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.