Safety CI > eyalev/jsonapp

dependabot/pip/cryptography-3.2

2 days, 4 hours ago

Bump cryptography from 2.0.3 to 3.2 Bumps [cryptography](https://github.com/pyca/cryptography) from

pip 9.0.1, Sphinx 1.6.3 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pip	9.0.1	<19.2	show The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
Sphinx	1.6.3	<3.0.4	show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons.
cryptography	3.2	<=3.2	show Cryptography 3.2 was released with the warning that its maintainers became aware of a Bleichenbacher vulnerability that they were only partly able to mitigate. See: CVE-2020-25659.
PyYAML	3.12	<4	show Pyyaml before 4 uses ``yaml.load`` which has been assigned CVE-2017-18342.
PyYAML	3.12	<5.3.1	show A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor. See: CVE-2020-1747.

dependabot/pip/pyyaml-5.1

1 year ago

90389c8c

Bump pyyaml from 3.12 to 5.1 Bumps [pyyaml](https://github.com/yaml/pyyaml) from 3.12 to 5.1. - [Re

cryptography 2.0.3 has known security vulnerabilities.

Package	Installed	Affected	Info
cryptography	2.0.3	<=3.2	show Cryptography 3.2 was released with the warning that its maintainers became aware of a Bleichenbacher vulnerability that they were only partly able to mitigate. See: CVE-2020-25659.
cryptography	2.0.3	>=1.9.0,<2.3	show python-cryptography versions >=1.9.0 and <2.3 did not enforce a minimum tag length for finalize_with_tag API. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

Package

Installed

Affected

Info

cryptography

2.0.3

<=3.2

show

Cryptography 3.2 was released with the warning that its maintainers became aware of a Bleichenbacher vulnerability that they were only partly able to mitigate. See: CVE-2020-25659.

cryptography

2.0.3

>=1.9.0,<2.3

show

python-cryptography versions >=1.9.0 and <2.3 did not enforce a minimum tag length for finalize_with_tag API. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

master

2 years, 6 months ago