Safety CI > dubirajara/slack-Bot

pyup-update-beautifulsoup4-4.8.2-to-4.11.0

3 years, 7 months ago

42007740

Update beautifulsoup4 from 4.8.2 to 4.11.0

No dependencies with known security vulnerabilities.

pyup-update-bleach-3.3.0-to-5.0.0

3 years, 7 months ago

d197c1e6

Update bleach from 3.3.0 to 5.0.0

No dependencies with known security vulnerabilities.

pyup-update-flask-2.0.3-to-2.1.1

3 years, 7 months ago

0e96e131

Update flask from 2.0.3 to 2.1.1

No dependencies with known security vulnerabilities.

pyup-update-flask-2.0.3-to-2.1.0

3 years, 7 months ago

b8ab276a

Update flask from 2.0.3 to 2.1.0

No dependencies with known security vulnerabilities.

master

3 years, 7 months ago

94de9214

Merge pull request #177 from dubirajara/pyup-update-flask-1.1.1-to-2.0.3

No dependencies with known security vulnerabilities.

pyup-update-selenium-4.1.2-to-4.1.3

3 years, 7 months ago

ed752c97

Update selenium from 4.1.2 to 4.1.3

No dependencies with known security vulnerabilities.

master

3 years, 8 months ago

b672673a

Merge pull request #180 from dubirajara/pyup-update-selenium-3.141.0-to-4.1.2

No dependencies with known security vulnerabilities.

pyup-update-selenium-3.141.0-to-4.1.2

3 years, 8 months ago

7a480996

Update selenium from 3.141.0 to 4.1.2

No dependencies with known security vulnerabilities.

pyup-update-selenium-3.141.0-to-4.1.1

3 years, 8 months ago

afdbff11

Update selenium from 3.141.0 to 4.1.1

No dependencies with known security vulnerabilities.

pyup-update-lxml-4.7.1-to-4.8.0

3 years, 8 months ago

ee0a37ad

Update lxml from 4.7.1 to 4.8.0

No dependencies with known security vulnerabilities.

pyup-update-flask-1.1.1-to-2.0.3

3 years, 8 months ago

0a81d28a

Update flask from 1.1.1 to 2.0.3

No dependencies with known security vulnerabilities.

master

3 years, 8 months ago

d3bc74fa

Update runtime.txt

No dependencies with known security vulnerabilities.

master

3 years, 8 months ago

b7d683da

Merge pull request #174 from dubirajara/pyup-update-lxml-4.6.2-to-4.7.1 Update lxml to 4.7.1

No dependencies with known security vulnerabilities.

master

3 years, 8 months ago

ec854ae3

Merge pull request #156 from dubirajara/pyup-update-flask-sqlalchemy-2.4.1-to-2.5.1 Update flask-sq

lxml 4.6.2 has known security vulnerabilities.

Package	Installed	Affected	Info
lxml	4.6.2	<4.6.3	show Lxml version 4.6.3 includes a fix for CVE-2021-28957: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formation attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. https://bugs.launchpad.net/lxml/+bug/1888153
lxml	4.6.2	<4.9.1	show Lxml 4.9.1 includes a fix for CVE-2022-2309: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
lxml	4.6.2	<4.6.5	show Lxml 4.6.5 includes a fix for CVE-2021-43818: Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch.

Package

Installed

Affected

Info

lxml

4.6.2

<4.6.3

show

Lxml version 4.6.3 includes a fix for CVE-2021-28957: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formation attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML.
https://bugs.launchpad.net/lxml/+bug/1888153

lxml

4.6.2

<4.9.1

show

Lxml 4.9.1 includes a fix for CVE-2022-2309: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

lxml

4.6.2

<4.6.5

show

Lxml 4.6.5 includes a fix for CVE-2021-43818: Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch.

pyup-update-requests-2.22.0-to-2.27.1

3 years, 10 months ago

1e5aaf40

Update requests from 2.22.0 to 2.27.1

lxml 4.6.2 has known security vulnerabilities.

Package	Installed	Affected	Info
lxml	4.6.2	<4.6.3	show Lxml version 4.6.3 includes a fix for CVE-2021-28957: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formation attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. https://bugs.launchpad.net/lxml/+bug/1888153
lxml	4.6.2	<4.9.1	show Lxml 4.9.1 includes a fix for CVE-2022-2309: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
lxml	4.6.2	<4.6.5	show Lxml 4.6.5 includes a fix for CVE-2021-43818: Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch.

Package

Installed

Affected

Info

lxml

4.6.2

<4.6.3

show

Lxml version 4.6.3 includes a fix for CVE-2021-28957: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formation attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML.
https://bugs.launchpad.net/lxml/+bug/1888153

lxml

4.6.2

<4.9.1

show

Lxml 4.9.1 includes a fix for CVE-2022-2309: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

lxml

4.6.2

<4.6.5

show

Lxml 4.6.5 includes a fix for CVE-2021-43818: Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch.