Safety CI > bubylou/scsm

pyup-scheduled-update-2023-01-01

2 years, 11 months ago

a21f0b62

Update tox from 3.24.4 to 4.1.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-01-01

2 years, 11 months ago

af07adaa

Update setuptools from 59.4.0 to 65.6.3

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-01-01

2 years, 11 months ago

66b78390

Update ruamel.yaml from 0.17.17 to 0.17.21

setuptools 59.4.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	59.4.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
setuptools	59.4.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	59.4.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

Package

Installed

Affected

Info

setuptools

59.4.0

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

setuptools

59.4.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

setuptools

59.4.0

<70.0.0

show

Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

pyup-scheduled-update-2023-01-01

2 years, 11 months ago

0f5927a8

Update pytest from 6.2.5 to 7.2.0

setuptools 59.4.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	59.4.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
setuptools	59.4.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	59.4.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

Package

Installed

Affected

Info

setuptools

59.4.0

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

setuptools

59.4.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

setuptools

59.4.0

<70.0.0

show

Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

pyup-scheduled-update-2023-01-01

2 years, 11 months ago

30f46959

Update flake8 from 4.0.1 to 6.0.0

libtmux 0.10.2 and setuptools 59.4.0 have known security vulnerabilities.

Package	Installed	Affected	Info
libtmux	0.10.2	<0.11.0	show Libtmux 0.11.0 updates its dependency 'brotly' to versions >=1.0.9 to include a security fix.
setuptools	59.4.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
setuptools	59.4.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	59.4.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

pyup-scheduled-update-2023-01-01

2 years, 11 months ago

b7ffdb82

Update libtmux from 0.10.2 to 0.18.2

setuptools 59.4.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	59.4.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
setuptools	59.4.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	59.4.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

Package

Installed

Affected

Info

setuptools

59.4.0

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

setuptools

59.4.0

<65.5.1

show

Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

setuptools

59.4.0

<70.0.0

show

Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

pyup-scheduled-update-2023-01-01

2 years, 11 months ago

f4ed8b54

Update coverage from 6.2 to 7.0.1

libtmux 0.10.2 and setuptools 59.4.0 have known security vulnerabilities.

Package	Installed	Affected	Info
libtmux	0.10.2	<0.11.0	show Libtmux 0.11.0 updates its dependency 'brotly' to versions >=1.0.9 to include a security fix.
setuptools	59.4.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
setuptools	59.4.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	59.4.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

pyup-scheduled-update-2023-01-01

2 years, 11 months ago

b354426d

Update click from 8.0.3 to 8.1.3

libtmux 0.10.2 and setuptools 59.4.0 have known security vulnerabilities.

Package	Installed	Affected	Info
libtmux	0.10.2	<0.11.0	show Libtmux 0.11.0 updates its dependency 'brotly' to versions >=1.0.9 to include a security fix.
setuptools	59.4.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
setuptools	59.4.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	59.4.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.

pyup-scheduled-update-2022-12-01

3 years ago

a4f0b168

Update tox from 3.24.4 to 3.27.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-12-01

3 years ago

6ff1093f

Update setuptools from 59.4.0 to 65.6.3

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-12-01

3 years ago

03dc195b

Update ruamel.yaml from 0.17.17 to 0.17.21

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-12-01

3 years ago

e533439b

Update pytest from 6.2.5 to 7.2.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-12-01

3 years ago

10a62a36

Update libtmux from 0.10.2 to 0.15.10

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-12-01

3 years ago

3541fb8d

Update flake8 from 4.0.1 to 6.0.0

libtmux 0.10.2 has known security vulnerabilities.

Package	Installed	Affected	Info
libtmux	0.10.2	<0.11.0	show Libtmux 0.11.0 updates its dependency 'brotly' to versions >=1.0.9 to include a security fix.

pyup-scheduled-update-2022-12-01

3 years ago

4bca4af1

Update coverage from 6.2 to 6.5.0

libtmux 0.10.2 has known security vulnerabilities.

Package	Installed	Affected	Info
libtmux	0.10.2	<0.11.0	show Libtmux 0.11.0 updates its dependency 'brotly' to versions >=1.0.9 to include a security fix.