Safety CI > cookiecutter/cookiecutter-django

pyup-update-uvicorn-0.11.6-to-0.11.7

5 years, 12 months ago

Update uvicorn from 0.11.6 to 0.11.7

uvicorn 0.11.7 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.7	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848

pyup-update-tox-3.18.0-to-3.18.1

5 years, 12 months ago

84a30825

Update tox from 3.18.0 to 3.18.1

uvicorn 0.11.6 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.6	<0.11.7	show The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.
uvicorn	0.11.6	<0.11.7	show Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
uvicorn	0.11.6	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848

Package

Installed

Affected

Info

uvicorn

0.11.6

<0.11.7

show

The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

uvicorn

0.11.6

<0.11.7

show

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

uvicorn

0.11.6

<0.12.3

show

Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability.
https://github.com/encode/uvicorn/pull/848

master

5 years, 12 months ago

0f1dfdd7

Merge pull request #2704 from manonthemat/master Added most recent supported PostgreSQL version in

uvicorn 0.11.6 has known security vulnerabilities.

Package	Installed	Affected	Info
uvicorn	0.11.6	<0.11.7	show The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.
uvicorn	0.11.6	<0.11.7	show Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
uvicorn	0.11.6	<0.12.3	show Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability. https://github.com/encode/uvicorn/pull/848

Package

Installed

Affected

Info

uvicorn

0.11.6

<0.11.7

show

The request logger provided by Uvicorn prior to version 0.11.7 is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file). See: CVE-2020-7694.

uvicorn

0.11.6

<0.11.7

show

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

uvicorn

0.11.6

<0.12.3

show

Uvicorn 0.12.3 includes a fix for a Race Condition vulnerability.
https://github.com/encode/uvicorn/pull/848

pyup-update-isort-4.3.21-to-5.2.0

5 years, 12 months ago

30699085

Update isort from 4.3.21 to 5.2.0