pyup-scheduled-update-2023-05-01
3 years ago
Update coverage from 7.1.0 to 7.2.5
py 1.11.0 and py 1.11.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
pyup-scheduled-update-2023-05-01
3 years ago
Update codecov from 2.1.12 to 2.1.13
py 1.11.0 and py 1.11.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
pyup-scheduled-update-2023-05-01
3 years ago
Update charset-normalizer from 3.0.1 to 3.1.0
py 1.11.0 and py 1.11.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
pyup-scheduled-update-2023-05-01
3 years ago
Update typing-extensions from 4.4.0 to 4.5.0
py 1.11.0 and py 1.11.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
pyup-scheduled-update-2023-05-01
3 years ago
Update urllib3 from 1.26.14 to 2.0.1
py 1.11.0 and py 1.11.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
pyup-scheduled-update-2023-05-01
3 years ago
Update sqlparse from 0.4.3 to 0.4.4
py 1.11.0 and py 1.11.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
pyup-scheduled-update-2023-05-01
3 years ago
Update setuptools from 67.1.0 to 67.7.2
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
pyup-scheduled-update-2023-05-01
3 years ago
Update sentry-sdk from 1.14.0 to 1.21.1
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
pyup-scheduled-update-2023-05-01
3 years ago
Update python-decouple from 3.7 to 3.8
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
pyup-scheduled-update-2023-05-01
3 years ago
Update pytest from 7.2.1 to 7.3.1
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
pyup-scheduled-update-2023-05-01
3 years ago
Update pygments from 2.14.0 to 2.15.1
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
pyup-scheduled-update-2023-05-01
3 years ago
Update psycopg2-binary from 2.9.5 to 2.9.6
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
pyup-scheduled-update-2023-05-01
3 years ago
Update prompt-toolkit from 3.0.36 to 3.0.38
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
pyup-scheduled-update-2023-05-01
3 years ago
Update packaging from 23.0 to 23.1
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
pyup-scheduled-update-2023-05-01
3 years ago
Update model-bakery from 1.10.1 to 1.11.0
py 1.11.0, py 1.11.0 and sqlparse 0.4.3 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| py | 1.11.0 | <=1.11.0 |
show ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. https://github.com/pytest-dev/py/issues/287 |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of the sqlparse package are vulnerable to Denial of Service (DoS) due to missing hard limits on token grouping recursion depth and token processing when formatting very large SQL tuple lists. During sqlparse.format() processing, the sqlparse.engine.grouping._group_matching() and sqlparse.engine.grouping._group() functions can recurse and iterate over excessively large tlist.tokens without enforcing MAX_GROUPING_DEPTH or MAX_GROUPING_TOKENS, allowing grouping work to grow until it effectively hangs. |
| sqlparse | 0.4.3 | <0.5.4 |
show Affected versions of this package are vulnerable to Denial of Service (DoS) attacks due to Algorithmic Complexity. The SQL parser fails to enforce limits when processing deeply nested tuples and large token sequences, leading to excessive resource consumption through crafted SQL statements with extreme nesting depth or token counts. **Note:** This issue is due to an incomplete fix for CVE-2024-4340. |
| sqlparse | 0.4.3 | <0.5.0 |
show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process. |
| sqlparse | 0.4.3 | >=0.1.15,<0.4.4 |
show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2 |
Python 3 badge
URL
https://pyup.io/repos/github/igoraserpac/learning-django/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/igoraserpac/learning-django/)
Restructured Text
.. image:: https://pyup.io/repos/github/igoraserpac/learning-django/python-3-shield.svg
:target: https://pyup.io/repos/github/igoraserpac/learning-django/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/igoraserpac/learning-django/"><img src="https://pyup.io/repos/github/igoraserpac/learning-django/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/igoraserpac/learning-django/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/igoraserpac/learning-django/
RDoc
{<img src="https://pyup.io/repos/github/igoraserpac/learning-django/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/igoraserpac/learning-django/]
pyup.io badge
URL
https://pyup.io/repos/github/igoraserpac/learning-django/shield.svg
Markdown
[](https://pyup.io/repos/github/igoraserpac/learning-django/)
Restructured Text
.. image:: https://pyup.io/repos/github/igoraserpac/learning-django/shield.svg
:target: https://pyup.io/repos/github/igoraserpac/learning-django/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/igoraserpac/learning-django/"><img src="https://pyup.io/repos/github/igoraserpac/learning-django/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/igoraserpac/learning-django/shield.svg(Updates)!:https://pyup.io/repos/github/igoraserpac/learning-django/
RDoc
{<img src="https://pyup.io/repos/github/igoraserpac/learning-django/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/igoraserpac/learning-django/]