Safety CI > dssg/triage

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

a0ce235d

Update flake8 from 4.0.1 to 7.1.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

0455186b

Update hypothesis from 6.46.1 to 6.122.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

835c8920

Update fakeredis from 1.7.1 to 2.26.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

54995dbe

Update moto from 3.1.7 to 5.0.21

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

951bf31e

Update pytest-cov from 3.0.0 to 6.0.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

f0fc4f5f

Update factory_boy from 3.2.1 to 3.3.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

6dfa235a

Update csvkit from 1.0.7 to 2.0.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

d97a0783

Update aequitas from 0.42.0 to 1.0.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

73e56b93

Update seaborn from 0.11.2 to 0.13.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

5c23105b

Update matplotlib from 3.5.1 to 3.9.3

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

c02edbce

Update scikit-learn from 1.0.2 to 1.5.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

cab3acd9

Update scipy from 1.8.0 to 1.14.1

scikit-learn 1.0.2 has known security vulnerabilities.

Package	Installed	Affected	Info
scikit-learn	1.0.2	<1.5.0	show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
scikit-learn	1.0.2	<1.1.0rc1	show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.

Package

Installed

Affected

Info

scikit-learn

1.0.2

<1.5.0

show

A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

scikit-learn

1.0.2

<1.1.0rc1

show

* Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. 
NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

c30a14f6

Update requests from 2.31.0 to 2.32.3

scikit-learn 1.0.2 has known security vulnerabilities.

Package	Installed	Affected	Info
scikit-learn	1.0.2	<1.5.0	show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
scikit-learn	1.0.2	<1.1.0rc1	show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.

Package

Installed

Affected

Info

scikit-learn

1.0.2

<1.5.0

show

A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

scikit-learn

1.0.2

<1.1.0rc1

show

* Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. 
NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

2dd52331

Update graphviz from 0.20 to 0.20.3

requests 2.31.0 and scikit-learn 1.0.2 have known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.31.0	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.31.0	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
scikit-learn	1.0.2	<1.5.0	show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
scikit-learn	1.0.2	<1.1.0rc1	show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.

pyup-scheduled-update-2024-12-01

8 months, 2 weeks ago

4da21905

Update adjusttext from 0.7.3 to 1.3.0

requests 2.31.0 and scikit-learn 1.0.2 have known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.31.0	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.31.0	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
scikit-learn	1.0.2	<1.5.0	show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
scikit-learn	1.0.2	<1.1.0rc1	show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.