pyup-update-more-itertools-10.2.0-to-10.3.0
10 months, 2 weeks ago
Update more-itertools from 10.2.0 to 10.3.0
idna 3.6, py 1.11.0, peewee 3.16.3 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| PyMySQL | 1.0.3 | <1.1.1 |
show PyMySQL 1.1.1 addresses CVE-2024-36039, a critical SQL injection vulnerability present in versions up to 1.1.0. This vulnerability occurs when the library is used with untrusted JSON input because keys are not properly escaped by escape_dict, allowing attackers to inject malicious SQL queries. |
| requests | 2.31.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-packaging-23.2-to-24.1
10 months, 2 weeks ago
Update packaging from 23.2 to 24.1
idna 3.6, py 1.11.0, peewee 3.16.3 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| PyMySQL | 1.0.3 | <1.1.1 |
show PyMySQL 1.1.1 addresses CVE-2024-36039, a critical SQL injection vulnerability present in versions up to 1.1.0. This vulnerability occurs when the library is used with untrusted JSON input because keys are not properly escaped by escape_dict, allowing attackers to inject malicious SQL queries. |
| requests | 2.31.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-pytest-8.0.0-to-8.2.2
10 months, 3 weeks ago
Update pytest from 8.0.0 to 8.2.2
idna 3.6, py 1.11.0, peewee 3.16.3 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| PyMySQL | 1.0.3 | <1.1.1 |
show PyMySQL 1.1.1 addresses CVE-2024-36039, a critical SQL injection vulnerability present in versions up to 1.1.0. This vulnerability occurs when the library is used with untrusted JSON input because keys are not properly escaped by escape_dict, allowing attackers to inject malicious SQL queries. |
| requests | 2.31.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-certifi-2023.7.22-to-2024.6.2
10 months, 3 weeks ago
Update certifi from 2023.7.22 to 2024.6.2
idna 3.6, py 1.11.0, peewee 3.16.3 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| PyMySQL | 1.0.3 | <1.1.1 |
show PyMySQL 1.1.1 addresses CVE-2024-36039, a critical SQL injection vulnerability present in versions up to 1.1.0. This vulnerability occurs when the library is used with untrusted JSON input because keys are not properly escaped by escape_dict, allowing attackers to inject malicious SQL queries. |
| requests | 2.31.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-requests-2.31.0-to-2.32.3
11 months ago
Update requests from 2.31.0 to 2.32.3
idna 3.6, py 1.11.0, peewee 3.16.3 and 2 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| PyMySQL | 1.0.3 | <1.1.1 |
show PyMySQL 1.1.1 addresses CVE-2024-36039, a critical SQL injection vulnerability present in versions up to 1.1.0. This vulnerability occurs when the library is used with untrusted JSON input because keys are not properly escaped by escape_dict, allowing attackers to inject malicious SQL queries. |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-requests-2.31.0-to-2.32.2
11 months, 1 week ago
Update requests from 2.31.0 to 2.32.2
idna 3.6, py 1.11.0, peewee 3.16.3 and 2 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| PyMySQL | 1.0.3 | <1.1.1 |
show PyMySQL 1.1.1 addresses CVE-2024-36039, a critical SQL injection vulnerability present in versions up to 1.1.0. This vulnerability occurs when the library is used with untrusted JSON input because keys are not properly escaped by escape_dict, allowing attackers to inject malicious SQL queries. |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-pymysql-1.0.3-to-1.1.1
11 months, 1 week ago
Update pymysql from 1.0.3 to 1.1.1
idna 3.6, py 1.11.0, peewee 3.16.3 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-requests-2.31.0-to-2.32.1
11 months, 1 week ago
Update requests from 2.31.0 to 2.32.1
idna 3.6, py 1.11.0, peewee 3.16.3 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-requests-2.31.0-to-2.32.0
11 months, 1 week ago
Update requests from 2.31.0 to 2.32.0
idna 3.6, py 1.11.0, peewee 3.16.3 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-pytest-8.0.0-to-8.2.1
11 months, 1 week ago
Update pytest from 8.0.0 to 8.2.1
idna 3.6, py 1.11.0, peewee 3.16.3 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-lxml-4.9.4-to-5.2.2
11 months, 2 weeks ago
Update lxml from 4.9.4 to 5.2.2
idna 3.6, py 1.11.0, peewee 3.16.3 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-peewee-3.16.3-to-3.17.5
11 months, 2 weeks ago
Update peewee from 3.16.3 to 3.17.5
idna 3.6, py 1.11.0 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-peewee-3.16.3-to-3.17.4
11 months, 2 weeks ago
Update peewee from 3.16.3 to 3.17.4
idna 3.6, py 1.11.0 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-filelock-3.13.1-to-3.14.0
12 months ago
Update filelock from 3.13.1 to 3.14.0
idna 3.6, py 1.11.0, peewee 3.16.3 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
pyup-update-pytest-8.0.0-to-8.2.0
12 months ago
Update pytest from 8.0.0 to 8.2.0
idna 3.6, py 1.11.0, peewee 3.16.3 and GitPython 3.1.40 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| idna | 3.6 | <3.7 |
show Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| peewee | 3.16.3 | <3.17.1 |
show Peewee 3.17.1 introduces enhancements to address a race condition issue by implementing stricter locking mechanisms around pool connection management. https://github.com/coleifer/peewee/commit/ea3fb11a9c2a4b0cd958a453dd287e408477eda5 |
| GitPython | 3.1.40 | <3.1.41 |
show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx |
Python 3 badge
URL
https://pyup.io/repos/github/athina-edu/athina/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/athina-edu/athina/)
Restructured Text
.. image:: https://pyup.io/repos/github/athina-edu/athina/python-3-shield.svg
:target: https://pyup.io/repos/github/athina-edu/athina/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/athina-edu/athina/"><img src="https://pyup.io/repos/github/athina-edu/athina/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/athina-edu/athina/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/athina-edu/athina/
RDoc
{<img src="https://pyup.io/repos/github/athina-edu/athina/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/athina-edu/athina/]
pyup.io badge
URL
https://pyup.io/repos/github/athina-edu/athina/shield.svg
Markdown
[](https://pyup.io/repos/github/athina-edu/athina/)
Restructured Text
.. image:: https://pyup.io/repos/github/athina-edu/athina/shield.svg
:target: https://pyup.io/repos/github/athina-edu/athina/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/athina-edu/athina/"><img src="https://pyup.io/repos/github/athina-edu/athina/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/athina-edu/athina/shield.svg(Updates)!:https://pyup.io/repos/github/athina-edu/athina/
RDoc
{<img src="https://pyup.io/repos/github/athina-edu/athina/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/athina-edu/athina/]