Safety CI > athina-edu/athina

master

2 years, 7 months ago

3a92e2b8

Update certifi from 2022.9.14 to 2022.9.24 (#397)

No dependencies with known security vulnerabilities.

pyup-update-certifi-2022.9.14-to-2022.9.24

2 years, 7 months ago

2c6d7bff

Update certifi from 2022.9.14 to 2022.9.24

No dependencies with known security vulnerabilities.

dependabot/pip/numpy-1.22.0

2 years, 7 months ago

fccdbd73

Bump numpy from 1.21.4 to 1.22.0 Bumps [numpy](https://github.com/numpy/numpy) from 1.21.4 to 1.22.

numpy 1.22.0 has known security vulnerabilities.

Package	Installed	Affected	Info
numpy	1.22.0	<1.22.2	show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.

Package

Installed

Affected

Info

numpy

1.22.0

<1.22.2

show

Numpy 1.22.2  includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. 
NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place.
NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.

master

2 years, 7 months ago

de412263

Update peewee from 3.15.2 to 3.15.3 (#396)

No dependencies with known security vulnerabilities.

pyup-update-peewee-3.15.2-to-3.15.3

2 years, 7 months ago

b24301fd

Update peewee from 3.15.2 to 3.15.3

No dependencies with known security vulnerabilities.

master

2 years, 7 months ago

17f60d07

Update certifi from 2022.6.15.2 to 2022.9.14 (#395)

No dependencies with known security vulnerabilities.

pyup-update-certifi-2022.6.15.2-to-2022.9.14

2 years, 7 months ago

0f9d32a5

Update certifi from 2022.6.15.2 to 2022.9.14

No dependencies with known security vulnerabilities.

master

2 years, 7 months ago

ca190e05

Update idna from 3.3 to 3.4 (#394)

No dependencies with known security vulnerabilities.

pyup-update-idna-3.3-to-3.4

2 years, 7 months ago

07687ca4

Update idna from 3.3 to 3.4

No dependencies with known security vulnerabilities.

master

2 years, 7 months ago

8e3a0f2b

Update certifi from 2022.6.15.1 to 2022.6.15.2 (#393)

No dependencies with known security vulnerabilities.

pyup-update-certifi-2022.6.15.1-to-2022.6.15.2

2 years, 7 months ago

4ae51cb0

Update certifi from 2022.6.15.1 to 2022.6.15.2

No dependencies with known security vulnerabilities.

pyup-update-cachecontrol-0.12.11-to-0.12.12

2 years, 7 months ago

777a3a9f

Update cachecontrol from 0.12.11 to 0.12.12

No dependencies with known security vulnerabilities.

master

2 years, 7 months ago

cd8f7087

Update certifi from 2022.6.15 to 2022.6.15.1 (#392)

No dependencies with known security vulnerabilities.

pyup-update-certifi-2022.6.15-to-2022.6.15.1

2 years, 7 months ago

06ef9fe1

Update certifi from 2022.6.15 to 2022.6.15.1

No dependencies with known security vulnerabilities.

dependabot/pip/numpy-1.22.0

2 years, 7 months ago

ed8fb016

Bump numpy from 1.21.4 to 1.22.0 Bumps [numpy](https://github.com/numpy/numpy) from 1.21.4 to 1.22.

numpy 1.22.0 has known security vulnerabilities.

Package	Installed	Affected	Info
numpy	1.22.0	<1.22.2	show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.

Package

Installed

Affected

Info

numpy

1.22.0

<1.22.2

show

Numpy 1.22.2  includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. 
NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place.
NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.