Safety CI > geokrety/geokrety-api-models

pyup-update-bcrypt-3.1.6-to-3.2.2

3 years, 4 months ago

Update bcrypt from 3.1.6 to 3.2.2

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-bcrypt-3.1.6-to-3.2.1

3 years, 4 months ago

b8e9f8b9

Update bcrypt from 3.1.6 to 3.2.1

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-sqlalchemy-1.2.17-to-1.4.36

3 years, 4 months ago

6ec86460

Update sqlalchemy from 1.2.17 to 1.4.36

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-bleach-3.1.0-to-5.0.0

3 years, 4 months ago

8c8b77da

Update bleach from 3.1.0 to 5.0.0

SQLAlchemy 1.2.17 has known security vulnerabilities.

Package	Installed	Affected	Info
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

Package

Installed

Affected

Info

SQLAlchemy

1.2.17

<=1.2.17 , >=1.3.0b1,<=1.3.0b2

show

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
https://github.com/sqlalchemy/sqlalchemy/issues/4481

SQLAlchemy

1.2.17

<2.0.0b1

show

Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints.
https://github.com/sqlalchemy/sqlalchemy/pull/8563

SQLAlchemy

1.2.17

<1.3.0

show

SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-sqlalchemy-1.2.17-to-1.4.35

3 years, 4 months ago

bbd2702f

Update sqlalchemy from 1.2.17 to 1.4.35

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-sqlalchemy-1.2.17-to-1.4.34

3 years, 5 months ago

4afc28cb

Update sqlalchemy from 1.2.17 to 1.4.34

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-sqlalchemy-1.2.17-to-1.4.33

3 years, 5 months ago

18ceb5db

Update sqlalchemy from 1.2.17 to 1.4.33

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-mixer-6.1.3-to-7.2.2

3 years, 5 months ago

0eba9352

Update mixer from 6.1.3 to 7.2.2

Server Error.

pyup-update-responses-0.10.5-to-0.20.0

3 years, 5 months ago

3f4a7a9d

Update responses from 0.10.5 to 0.20.0

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-responses-0.10.5-to-0.19.0

3 years, 5 months ago

1e0e397f

Update responses from 0.10.5 to 0.19.0

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-sqlalchemy-1.2.17-to-1.4.32

3 years, 5 months ago

be1dc417

Update sqlalchemy from 1.2.17 to 1.4.32

bleach 3.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

pyup-update-coverage-4.5.2-to-6.3.2

3 years, 6 months ago

7c20ee28

Update coverage from 4.5.2 to 6.3.2

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-mixer-6.1.3-to-7.2.1

3 years, 6 months ago

7cbe1bed

Update mixer from 6.1.3 to 7.2.1

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-responses-0.10.5-to-0.18.0

3 years, 6 months ago

0e62f764

Update responses from 0.10.5 to 0.18.0

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.

pyup-update-coverage-4.5.2-to-6.3.1

3 years, 6 months ago

d3fcb021

Update coverage from 4.5.2 to 6.3.1

bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	<=3.1.0	show Bleach 3.1.1 includes a fix for CVE-2020-6802: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
SQLAlchemy	1.2.17	<=1.2.17 , >=1.3.0b1,<=1.3.0b2	show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481
SQLAlchemy	1.2.17	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563
SQLAlchemy	1.2.17	<1.3.0	show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled.