Safety CI > crim-ca/weaver

fix-input-location-for-directory-type

3 years, 1 month ago

Fix CHANGES.rst, no Changes, all Fixes

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-input-location-for-directory-type

3 years, 1 month ago

074b8c05

Fix missing double quotes in CHANGES.rst

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-input-location-for-directory-type

3 years, 1 month ago

6758b711

Update CHANGES.rst

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 1 month ago

6c2b0961

[wip] job/quote I/O pre-validation + more quotation/schema impl + query params for process listing +

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 1 month ago

bfb8b045

patch new OGC schema locations (DRU still erronous, relates to https://github.com/opengeospatial/ogc

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 2 months ago

2f017a8f

[wip] more quotation impl + align with expected docker image results + quote schema definitions

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 2 months ago

eb69a39e

[wip] quote-estimator impl

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 2 months ago

f7ce1a17

prepare for quote-estimator integration

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-input-location-for-directory-type

3 years, 2 months ago

d3b8490a

Fix `input-location` definition for `PACKAGE_DIRECTORY_TYPE` input

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

add-cuda-requirements

3 years, 5 months ago

7257237d

fix lint

json2xml 3.18.0 has known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7

fix-cli-href-input

3 years, 6 months ago

1f656441

Fix functional/test_cli.py imports

json2xml 3.18.0 has known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7

dir-type

3 years, 6 months ago

b9bd0eed

first impl to handle CWL Directory type (relates to #466)

No dependencies with known security vulnerabilities.

master

3 years, 6 months ago

60c9f3d6

Bump version: 4.24.0 → 4.25.0

No dependencies with known security vulnerabilities.

master

3 years, 6 months ago

10961f8f

Merge pull request #471 from crim-ca/cwl-refactor-update

No dependencies with known security vulnerabilities.

cwl-refactor-update

3 years, 6 months ago

ae6306c7

update changelog (fix #154)

No dependencies with known security vulnerabilities.