Safety CI > dstrigl/HtREST

pyup-update-pytest-7.2.0-to-7.3.2

2 years, 1 month ago

Update pytest from 7.2.0 to 7.3.2

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-tox-3.27.1-to-4.6.0

2 years, 1 month ago

e8cf2403

Update tox from 3.27.1 to 4.6.0

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-coverage-6.5.0-to-7.2.7

2 years, 1 month ago

81d92c5f

Update coverage from 6.5.0 to 7.2.7

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-tox-3.27.1-to-4.5.2

2 years, 1 month ago

47c0def0

Update tox from 3.27.1 to 4.5.2

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-pytest-cov-4.0.0-to-4.1.0

2 years, 1 month ago

39f2ca40

Update pytest-cov from 4.0.0 to 4.1.0

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-coverage-6.5.0-to-7.2.6

2 years, 1 month ago

48bef2e5

Update coverage from 6.5.0 to 7.2.6

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-mypy-0.991-to-1.3.0

2 years, 2 months ago

6853a719

Update mypy from 0.991 to 1.3.0

Flask 2.2.2 and flask-restx 1.0.3 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	2.2.2	<3.1.1	show Affected versions of Flask (≤ 3.1.0) are vulnerable to incorrect fallback key configuration in session signing, leading to stale key usage instead of the intended current key. This flaw undermines session integrity, enabling remote attackers to forge or tamper with cookies via manipulated SECRET_KEY_FALLBACKS parameters. The vulnerability exists in the itsdangerous-based signing routines within flask.sessions (fallback key list ordering).
Flask	2.2.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.
flask-restx	1.0.3	<1.1.0	show Flask-restx 1.1.0 updates its NPM dependency 'swagger-ui-dist' to v4.15.0 to include security fixes.

pyup-update-flask-2.2.2-to-2.3.2

2 years, 2 months ago

665e1c9d

Update flask from 2.2.2 to 2.3.2