Safety CI > dstrigl/HtREST

master

2 years ago

67cc608b

Ongoing work

No dependencies with known security vulnerabilities.

master

2 years ago

8603050b

Added history statement for new (planned) version

No dependencies with known security vulnerabilities.

master

2 years ago

518ac3bb

Updated copyright statement

No dependencies with known security vulnerabilities.

master

2 years ago

2d7b2411

Ongoing work

No dependencies with known security vulnerabilities.

master

2 years ago

87321b82

Ongoing work

No dependencies with known security vulnerabilities.

master

2 years ago

d920fa85

Ongoing work

No dependencies with known security vulnerabilities.

master

2 years ago

49d61949

Ongoing work

No dependencies with known security vulnerabilities.

master

2 years ago

bcf526bd

Ongoing work

No dependencies with known security vulnerabilities.

master

2 years ago

2c467b63

Ongoing work

No dependencies with known security vulnerabilities.

pyup-update-mypy-0.991-to-1.4.1

2 years ago

fd94710f

Update mypy from 0.991 to 1.4.1

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-pytest-7.2.0-to-7.4.0

2 years ago

9a4284ed

Update pytest from 7.2.0 to 7.4.0

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-mypy-0.991-to-1.4.0

2 years ago

9dd47113

Update mypy from 0.991 to 1.4.0

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-tox-3.27.1-to-4.6.3

2 years ago

41e9398d

Update tox from 3.27.1 to 4.6.3

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-tox-3.27.1-to-4.6.2

2 years ago

06a0a959

Update tox from 3.27.1 to 4.6.2

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-tox-3.27.1-to-4.6.1

2 years ago

d60f5e67

Update tox from 3.27.1 to 4.6.1

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.