Safety CI > alphagov/notifications-api

pyup-scheduled-update-2021-03-31

5 years, 4 months ago

15571bc2

Update eventlet from 0.30.1 to 0.30.2

No dependencies with known security vulnerabilities.

master

5 years, 4 months ago

e5fabaa0

Merge pull request #3190 from alphagov/log-invalid-inbound-service Log service ID for invalid inbou

No dependencies with known security vulnerabilities.

log-invalid-inbound-service

5 years, 4 months ago

86b6217c

Log service ID for invalid inbound SMS This could help identify issues with inbound SMS for a servi

No dependencies with known security vulnerabilities.

master

5 years, 4 months ago

22004762

Merge pull request #3193 from alphagov/populate-annual-billing-2021 Populate annual billing for 202

No dependencies with known security vulnerabilities.

populate-annual-billing-2021

5 years, 4 months ago

0165ed9c

use true as the default.

No dependencies with known security vulnerabilities.

master

5 years, 4 months ago

1a6ad924

Merge pull request #3194 from alphagov/allow-double-hyphens-in-email-domains Bump utils to allow do

No dependencies with known security vulnerabilities.

populate-annual-billing-2021

5 years, 4 months ago

da8a7a8d

Avoid key errors by setting the year_start with 2020 or 2021 Remove db.create_service_with_organisat

No dependencies with known security vulnerabilities.

master

5 years, 4 months ago

2bf58c8a

Merge pull request #3187 from alphagov/remove-unecessary-code Simplify send_delivery_status_to_serv

No dependencies with known security vulnerabilities.

remove-unecessary-code

5 years, 4 months ago

3bfd084a

Simplify send_delivery_status_to_service code Now that https://github.com/alphagov/notifications-ap

No dependencies with known security vulnerabilities.

remove-unecessary-code

5 years, 4 months ago

efee7833

Simplify send_delivery_status_to_service code Now that https://github.com/alphagov/notifications-ap

No dependencies with known security vulnerabilities.

allow-double-hyphens-in-email-domains

5 years, 4 months ago

a3aad24f

Bump utils to allow double hyphens in email address domain It was requested by our user and it is a

No dependencies with known security vulnerabilities.

master

5 years, 4 months ago

d0458762

Merge pull request #3192 from alphagov/delete-canary Remove the emergency alerts canary

No dependencies with known security vulnerabilities.

remove-unecessary-code

5 years, 4 months ago

58ec42c2

Simplify send_delivery_status_to_service code Now that https://github.com/alphagov/notifications-ap

No dependencies with known security vulnerabilities.

populate-annual-billing-2021

5 years, 4 months ago

7da5abc1

The free sms allowances are changing for the financial year starting April 1 2021. In this PR there

No dependencies with known security vulnerabilities.

populate-annual-billing-2021

5 years, 4 months ago

3c88e82d

The free sms allowances are changing for the financial year starting April 1 2021. In this PR there

lxml 4.6.2 has known security vulnerabilities.

Package	Installed	Affected	Info
lxml	4.6.2	<6.1.0	show Affected versions of the lxml package are vulnerable to XML External Entity Injection due to insecure default parser configuration that resolves external entities. The iterparse() function and the ETCompatXMLParser() class both default to resolve_entities=True, so untrusted XML input processed through either parser will expand external entity references and read referenced local files from the host. An attacker who supplies a crafted XML document to an application using these parsers in their default configuration can read sensitive local files and exfiltrate their contents through the parsed output.
lxml	4.6.2	<4.9.1	show Lxml 4.9.1 includes a fix for CVE-2022-2309: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
lxml	4.6.2	<4.6.3	show Lxml version 4.6.3 includes a fix for CVE-2021-28957: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formation attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. https://bugs.launchpad.net/lxml/+bug/1888153
lxml	4.6.2	<4.6.5	show Lxml 4.6.5 includes a fix for CVE-2021-43818: Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch.