pyup-update-responses-0.10.5-to-0.25.3
2 years ago
Update responses from 0.10.5 to 0.25.3
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-responses-0.10.5-to-0.25.2
2 years ago
Update responses from 0.10.5 to 0.25.2
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-requests-2.21.0-to-2.32.3
2 years ago
Update requests from 2.21.0 to 2.32.3
bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-coverage-4.5.2-to-7.5.3
2 years ago
Update coverage from 4.5.2 to 7.5.3
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-coverage-4.5.2-to-7.5.2
2 years, 1 month ago
Update coverage from 4.5.2 to 7.5.2
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-requests-2.21.0-to-2.32.2
2 years, 1 month ago
Update requests from 2.21.0 to 2.32.2
bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-requests-2.21.0-to-2.32.1
2 years, 1 month ago
Update requests from 2.21.0 to 2.32.1
bleach 3.1.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-sqlalchemy-1.2.17-to-2.0.30
2 years, 1 month ago
Update sqlalchemy from 1.2.17 to 2.0.30
bleach 3.1.0 and requests 2.21.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
pyup-update-coverage-4.5.2-to-7.5.1
2 years, 1 month ago
Update coverage from 4.5.2 to 7.5.1
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-bcrypt-3.1.6-to-4.1.3
2 years, 1 month ago
Update bcrypt from 3.1.6 to 4.1.3
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-coverage-4.5.2-to-7.5.0
2 years, 2 months ago
Update coverage from 4.5.2 to 7.5.0
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-sqlalchemy-1.2.17-to-2.0.29
2 years, 3 months ago
Update sqlalchemy from 1.2.17 to 2.0.29
bleach 3.1.0 and requests 2.21.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
pyup-update-coverage-4.5.2-to-7.4.4
2 years, 3 months ago
Update coverage from 4.5.2 to 7.4.4
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-update-sqlalchemy-1.2.17-to-2.0.28
2 years, 3 months ago
Update sqlalchemy from 1.2.17 to 2.0.28
bleach 3.1.0 and requests 2.21.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
pyup-update-coverage-4.5.2-to-7.4.3
2 years, 4 months ago
Update coverage from 4.5.2 to 7.4.3
bleach 3.1.0, requests 2.21.0 and SQLAlchemy 1.2.17 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bleach | 3.1.0 | <=3.1.3 |
show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}). |
| bleach | 3.1.0 | <3.1.2 |
show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743 |
| bleach | 3.1.0 | <3.3.0 |
show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True. |
| bleach | 3.1.0 | >=2.1,<3.1.1 |
show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session. |
| requests | 2.21.0 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.21.0 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.21.0 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.21.0 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| SQLAlchemy | 1.2.17 | <1.3.0 |
show SQLAlchemy affected versions has SQL Injection when the group_by parameter can be controlled. |
| SQLAlchemy | 1.2.17 | <=1.2.17 , >=1.3.0b1,<=1.3.0b2 |
show SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. https://github.com/sqlalchemy/sqlalchemy/issues/4481 |
| SQLAlchemy | 1.2.17 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
Python 3 badge
URL
https://pyup.io/repos/github/geokrety/geokrety-api-models/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/geokrety/geokrety-api-models/)
Restructured Text
.. image:: https://pyup.io/repos/github/geokrety/geokrety-api-models/python-3-shield.svg
:target: https://pyup.io/repos/github/geokrety/geokrety-api-models/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/geokrety/geokrety-api-models/"><img src="https://pyup.io/repos/github/geokrety/geokrety-api-models/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/geokrety/geokrety-api-models/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/geokrety/geokrety-api-models/
RDoc
{<img src="https://pyup.io/repos/github/geokrety/geokrety-api-models/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/geokrety/geokrety-api-models/]
pyup.io badge
URL
https://pyup.io/repos/github/geokrety/geokrety-api-models/shield.svg
Markdown
[](https://pyup.io/repos/github/geokrety/geokrety-api-models/)
Restructured Text
.. image:: https://pyup.io/repos/github/geokrety/geokrety-api-models/shield.svg
:target: https://pyup.io/repos/github/geokrety/geokrety-api-models/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/geokrety/geokrety-api-models/"><img src="https://pyup.io/repos/github/geokrety/geokrety-api-models/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/geokrety/geokrety-api-models/shield.svg(Updates)!:https://pyup.io/repos/github/geokrety/geokrety-api-models/
RDoc
{<img src="https://pyup.io/repos/github/geokrety/geokrety-api-models/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/geokrety/geokrety-api-models/]