Safety CI > crim-ca/weaver

fix-lint

3 years, 1 month ago

c09296f2

add geotiff!=0.2.6,!=0.2.7 to avoid issue when attempting to install zarr package (relates to https:

No dependencies with known security vulnerabilities.

fix-lint

3 years, 1 month ago

67fcc6a1

add geotiff!=2.6,!=2.7 to avoid issue when attempting to install zarr package (relates to https://gi

No dependencies with known security vulnerabilities.

fix-lint

3 years, 1 month ago

c56673ef

ignore legacy requirements vulnerabilities

No dependencies with known security vulnerabilities.

fix-lint

3 years, 1 month ago

46660dd8

fix broken documentation references

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-lint

3 years, 1 month ago

db003500

fix linting issues

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 1 month ago

9567f148

[wip] fix tests

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-input-location-for-directory-type

3 years, 1 month ago

2c888096

Fix CHANGES.rst, no Changes, all Fixes

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-input-location-for-directory-type

3 years, 1 month ago

074b8c05

Fix missing double quotes in CHANGES.rst

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-input-location-for-directory-type

3 years, 1 month ago

6758b711

Update CHANGES.rst

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 1 month ago

6c2b0961

[wip] job/quote I/O pre-validation + more quotation/schema impl + query params for process listing +

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 1 month ago

bfb8b045

patch new OGC schema locations (DRU still erronous, relates to https://github.com/opengeospatial/ogc

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 2 months ago

2f017a8f

[wip] more quotation impl + align with expected docker image results + quote schema definitions

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 2 months ago

eb69a39e

[wip] quote-estimator impl

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 2 months ago

f7ce1a17

prepare for quote-estimator integration

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-input-location-for-directory-type

3 years, 2 months ago

d3b8490a

Fix `input-location` definition for `PACKAGE_DIRECTORY_TYPE` input

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.