Safety CI > cookiecutter/cookiecutter-django

pyup-update-pytest-5.4.3-to-6.0.0

5 years, 9 months ago

Update pytest from 5.4.3 to 6.0.0

uvicorn 0.11.7 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.7	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848

pyup-update-pytest-5.4.3-to-6.0.0

5 years, 9 months ago

b3170fc6

Update pytest from 5.4.3 to 6.0.0

uvicorn 0.11.7 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.7	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848

master

5 years, 9 months ago

58882b6a

Add missing link to Github profile

uvicorn 0.11.7 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.7	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848

master

5 years, 9 months ago

b148740a

Merge pull request #2707 from pydanny/pyup-update-uvicorn-0.11.6-to-0.11.7 Update uvicorn to 0.11.7

uvicorn 0.11.7 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.7	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848

pyup-update-isort-4.3.21-to-5.2.1

5 years, 9 months ago

8520526e

Update isort from 4.3.21 to 5.2.1

uvicorn 0.11.6 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.6	<0.11.7	show Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
uvicorn	0.11.6	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848
uvicorn	0.11.6	<0.11.7	show The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

Package

Installed

Affected

Info

uvicorn

0.11.6

<0.11.7

show

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

uvicorn

0.11.6

<0.12.3

show

Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability.
https://github.com/encode/uvicorn/pull/848

uvicorn

0.11.6

<0.11.7

show

The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

master

5 years, 9 months ago

d41bf740

Merge pull request #2706 from pydanny/pyup-update-tox-3.18.0-to-3.18.1 Update tox to 3.18.1

uvicorn 0.11.6 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.6	<0.11.7	show Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
uvicorn	0.11.6	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848
uvicorn	0.11.6	<0.11.7	show The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

Package

Installed

Affected

Info

uvicorn

0.11.6

<0.11.7

show

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

uvicorn

0.11.6

<0.12.3

show

Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability.
https://github.com/encode/uvicorn/pull/848

uvicorn

0.11.6

<0.11.7

show

The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

pyup-update-uvicorn-0.11.6-to-0.11.7

5 years, 9 months ago

4b4bda78

Update uvicorn from 0.11.6 to 0.11.7

uvicorn 0.11.7 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.7	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848

pyup-update-tox-3.18.0-to-3.18.1

5 years, 9 months ago

84a30825

Update tox from 3.18.0 to 3.18.1

uvicorn 0.11.6 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.6	<0.11.7	show Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
uvicorn	0.11.6	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848
uvicorn	0.11.6	<0.11.7	show The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

Package

Installed

Affected

Info

uvicorn

0.11.6

<0.11.7

show

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

uvicorn

0.11.6

<0.12.3

show

Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability.
https://github.com/encode/uvicorn/pull/848

uvicorn

0.11.6

<0.11.7

show

The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

master

5 years, 9 months ago

0f1dfdd7

Merge pull request #2704 from manonthemat/master Added most recent supported PostgreSQL version in

uvicorn 0.11.6 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.6	<0.11.7	show Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
uvicorn	0.11.6	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848
uvicorn	0.11.6	<0.11.7	show The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

Package

Installed

Affected

Info

uvicorn

0.11.6

<0.11.7

show

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

uvicorn

0.11.6

<0.12.3

show

Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability.
https://github.com/encode/uvicorn/pull/848

uvicorn

0.11.6

<0.11.7

show

The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

pyup-update-isort-4.3.21-to-5.2.0

5 years, 9 months ago

30699085

Update isort from 4.3.21 to 5.2.0