Safety CI > athina-edu/athina

master

2 years, 7 months ago

2d994a51

Update numpy from 1.23.2 to 1.23.3 (#391)

No dependencies with known security vulnerabilities.

pyup-update-numpy-1.23.2-to-1.23.3

2 years, 7 months ago

0c23d56c

Update numpy from 1.23.2 to 1.23.3

No dependencies with known security vulnerabilities.

master

2 years, 7 months ago

7b961478

Update psutil from 5.9.1 to 5.9.2 (#390)

No dependencies with known security vulnerabilities.

pyup-update-psutil-5.9.1-to-5.9.2

2 years, 7 months ago

b57f2e55

Update psutil from 5.9.1 to 5.9.2

No dependencies with known security vulnerabilities.

pyup-update-pytest-7.1.2-to-7.1.3

2 years, 8 months ago

40ffd864

Update pytest from 7.1.2 to 7.1.3

No dependencies with known security vulnerabilities.

dependabot/pip/numpy-1.22.0

2 years, 8 months ago

61e51770

Bump numpy from 1.21.4 to 1.22.0 Bumps [numpy](https://github.com/numpy/numpy) from 1.21.4 to 1.22.

numpy 1.22.0 has known security vulnerabilities.

Package	Installed	Affected	Info
numpy	1.22.0	<1.22.2	show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.

Package

Installed

Affected

Info

numpy

1.22.0

<1.22.2

show

Numpy 1.22.2  includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. 
NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place.
NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.

master

2 years, 8 months ago

de8d31d0

Update peewee from 3.15.1 to 3.15.2 (#389)

No dependencies with known security vulnerabilities.

master

2 years, 8 months ago

353bbf5f

Update urllib3 from 1.26.11 to 1.26.12 (#387)

No dependencies with known security vulnerabilities.

master

2 years, 8 months ago

392b20c7

Update distlib from 0.3.5 to 0.3.6 (#388)

No dependencies with known security vulnerabilities.

pyup-update-peewee-3.15.1-to-3.15.2

2 years, 8 months ago

98c143c9

Update peewee from 3.15.1 to 3.15.2

No dependencies with known security vulnerabilities.

pyup-update-distlib-0.3.5-to-0.3.6

2 years, 8 months ago

6535d109

Update distlib from 0.3.5 to 0.3.6

No dependencies with known security vulnerabilities.

pyup-update-urllib3-1.26.11-to-1.26.12

2 years, 8 months ago

74b32503

Update urllib3 from 1.26.11 to 1.26.12

No dependencies with known security vulnerabilities.

dependabot/pip/numpy-1.22.0

2 years, 8 months ago

d33d9062

Bump numpy from 1.21.4 to 1.22.0 Bumps [numpy](https://github.com/numpy/numpy) from 1.21.4 to 1.22.

numpy 1.22.0 has known security vulnerabilities.

Package	Installed	Affected	Info
numpy	1.22.0	<1.22.2	show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.

Package

Installed

Affected

Info

numpy

1.22.0

<1.22.2

show

Numpy 1.22.2  includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. 
NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place.
NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.

master

2 years, 8 months ago

235e4b4c

Update numpy from 1.23.1 to 1.23.2 (#386)

No dependencies with known security vulnerabilities.

pyup-update-numpy-1.23.1-to-1.23.2

2 years, 8 months ago

9fba345f

Update numpy from 1.23.1 to 1.23.2

No dependencies with known security vulnerabilities.