Safety CI > crim-ca/weaver

docker-quoting-estimator

3 years, 2 months ago

prepare for quote-estimator integration

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-input-location-for-directory-type

3 years, 2 months ago

d3b8490a

Fix `input-location` definition for `PACKAGE_DIRECTORY_TYPE` input

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

add-cuda-requirements

3 years, 5 months ago

7257237d

fix lint

json2xml 3.18.0 has known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7

fix-cli-href-input

3 years, 6 months ago

1f656441

Fix functional/test_cli.py imports

json2xml 3.18.0 has known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7

dir-type

3 years, 6 months ago

b9bd0eed

first impl to handle CWL Directory type (relates to #466)