Safety CI > alshapton/SpacePY-X

pyup-update-setuptools-48.0.0-to-68.1.2

8 months, 2 weeks ago

3304b46b

Update setuptools from 48.0.0 to 68.1.2

requests 2.24.0 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.24.0	>=2.3.0,<2.31.0	show Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.24.0

>=2.3.0,<2.31.0

show

Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

pyup-update-setuptools-48.0.0-to-68.1.0

8 months, 2 weeks ago

a1a6bc6c

Update setuptools from 48.0.0 to 68.1.0

requests 2.24.0 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.24.0	>=2.3.0,<2.31.0	show Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.24.0

>=2.3.0,<2.31.0

show

Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

pyup-update-setuptools-48.0.0-to-68.0.0

10 months, 2 weeks ago

0a20d9a9

Update setuptools from 48.0.0 to 68.0.0

requests 2.24.0 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.24.0	>=2.3.0,<2.31.0	show Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.24.0

>=2.3.0,<2.31.0

show

Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

pyup-update-sphinx_rtd_theme-0.5.0-to-1.2.2

10 months, 3 weeks ago

a498bc6a

Update sphinx_rtd_theme from 0.5.0 to 1.2.2

requests 2.24.0 and setuptools 48.0.0 have known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.24.0	>=2.3.0,<2.31.0	show Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

requests

2.24.0

>=2.3.0,<2.31.0

show

Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

pyup-update-tinydb-4.1.1-to-4.8.0

10 months, 3 weeks ago

8c1e9b83

Update tinydb from 4.1.1 to 4.8.0

requests 2.24.0 and setuptools 48.0.0 have known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.24.0	>=2.3.0,<2.31.0	show Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

requests

2.24.0

>=2.3.0,<2.31.0

show

Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

pyup-update-sphinx_rtd_theme-0.5.0-to-1.2.1

11 months, 1 week ago

4e73e6ea

Update sphinx_rtd_theme from 0.5.0 to 1.2.1

requests 2.24.0 and setuptools 48.0.0 have known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.24.0	>=2.3.0,<2.31.0	show Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

requests

2.24.0

>=2.3.0,<2.31.0

show

Requests 2.31.0 includes a fix for CVE-2023-32681: Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use 'rebuild_proxies' to reattach the 'Proxy-Authorization' header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the 'Proxy-Authorization' header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information.

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

snyk-fix-f4c8f255890cf686f12dc2e693487bd2

11 months, 1 week ago

e88a6cf5

fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning

setuptools 48.0.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

pyup-update-requests-2.24.0-to-2.31.0

11 months, 2 weeks ago

89c2c6ac

Update requests from 2.24.0 to 2.31.0

setuptools 48.0.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

pyup-update-setuptools-48.0.0-to-67.8.0

11 months, 2 weeks ago

3ca90ae3

Update setuptools from 48.0.0 to 67.8.0

No dependencies with known security vulnerabilities.

pyup-update-requests-2.24.0-to-2.30.0

12 months ago

d4b8ed1b

Update requests from 2.24.0 to 2.30.0

setuptools 48.0.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

pyup-update-requests-2.24.0-to-2.29.0

1 year ago

f8b83b00

Update requests from 2.24.0 to 2.29.0

setuptools 48.0.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

pyup-update-setuptools-48.0.0-to-67.7.2

1 year ago

0a5aeee5

Update setuptools from 48.0.0 to 67.7.2

No dependencies with known security vulnerabilities.

pyup-update-setuptools-48.0.0-to-67.7.1

1 year ago

369f979b

Update setuptools from 48.0.0 to 67.7.1

No dependencies with known security vulnerabilities.

pyup-update-beautifulsoup4-4.9.1-to-4.12.2

1 year ago

8f437fa5

Update beautifulsoup4 from 4.9.1 to 4.12.2

setuptools 48.0.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

pyup-update-beautifulsoup4-4.9.1-to-4.12.1

1 year ago

098a9c5a

Update beautifulsoup4 from 4.9.1 to 4.12.1

setuptools 48.0.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	48.0.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages

Package

Installed

Affected

Info

setuptools

48.0.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages