Safety CI > anthonyhseb/googlesearch

pyup-update-pip-21.0.1-to-21.2.4

3 years, 8 months ago

eeb7c1bc

Update pip from 21.0.1 to 21.2.4

No dependencies with known security vulnerabilities.

pyup-update-pip-21.0.1-to-21.2.3

3 years, 8 months ago

616d5e8a

Update pip from 21.0.1 to 21.2.3

No dependencies with known security vulnerabilities.

pyup-update-pip-21.0.1-to-21.2.2

3 years, 8 months ago

de9803c4

Update pip from 21.0.1 to 21.2.2

coverage 4.1 has known security vulnerabilities.

Package	Installed	Affected	Info

pyup-update-pip-21.0.1-to-21.2.1

3 years, 9 months ago

ad5c9e83

Update pip from 21.0.1 to 21.2.1

coverage 4.1 has known security vulnerabilities.

Package	Installed	Affected	Info

pyup-update-pip-21.0.1-to-21.2

3 years, 9 months ago

5ff8aa4b

Update pip from 21.0.1 to 21.2

coverage 4.1 has known security vulnerabilities.

Package	Installed	Affected	Info

pyup-update-coverage-4.1-to-5.5

3 years, 9 months ago

4b7cdf98

Update coverage from 4.1 to 5.5

pip 21.0.1 and coverage 5.5 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	21.0.1	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	21.0.1	<21.1	show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.
pip	21.0.1	<21.1	show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues.
pip	21.0.1	<21.1	show An issue was discovered in Pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). A warning was added about this behavior in version 21.1. NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
pip	21.0.1	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.

pyup-update-pip-21.0.1-to-21.1.3

3 years, 10 months ago

66e14820

Update pip from 21.0.1 to 21.1.3

No dependencies with known security vulnerabilities.

pyup-update-pip-21.0.1-to-21.1.2

3 years, 11 months ago

531abbac

Update pip from 21.0.1 to 21.1.2

No dependencies with known security vulnerabilities.

pyup-update-pip-21.0.1-to-21.1.1

3 years, 11 months ago

6f92c719

Update pip from 21.0.1 to 21.1.1

No dependencies with known security vulnerabilities.

pyup-update-pip-21.0.1-to-21.1

3 years, 11 months ago

f7b95637

Update pip from 21.0.1 to 21.1

No dependencies with known security vulnerabilities.

master

4 years ago

e2d3e74a

bump version

No dependencies with known security vulnerabilities.

master

4 years ago

a752d552

Merge pull request #67 from michaelbukachi/master fix: Adding browser_agents.txt file

No dependencies with known security vulnerabilities.

master

4 years, 1 month ago

09c02467

Merge pull request #54 from anthonyhseb/pyup-update-pyyaml-3.11-to-5.4.1 Update pyyaml to 5.4.1

No dependencies with known security vulnerabilities.

pyup-update-pyyaml-3.11-to-5.4.1

4 years, 1 month ago

761e3ee4

Merge branch 'master' into pyup-update-pyyaml-3.11-to-5.4.1

No dependencies with known security vulnerabilities.

dependabot/pip/pyyaml-5.1

4 years, 1 month ago

e7cecdde

Bump pyyaml from 3.11 to 5.1 Bumps [pyyaml](https://github.com/yaml/pyyaml) from 3.11 to 5.1. - [Re

PyYAML 5.1 has known security vulnerabilities.

Package	Installed	Affected	Info
PyYAML	5.1	>=5.1,<=5.1.2	show PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. See CVE-2019-20477. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
PyYAML	5.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
PyYAML	5.1	<5.3.1	show Pyyaml 5.3.1 includes a fix for CVE-2020-1747: A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Package

Installed

Affected

Info

PyYAML

5.1

>=5.1,<=5.1.2

show

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. See CVE-2019-20477. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

PyYAML

5.1

<5.4

show

Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
https://bugzilla.redhat.com/show_bug.cgi?id=1860466

PyYAML

5.1

<5.3.1

show

Pyyaml 5.3.1 includes a fix for CVE-2020-1747: A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.