main
3 years, 6 months ago
Update NRTM missing/invalid %END error message (#688)
This was confusing users more than needed.
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
eventstream
3 years, 6 months ago
Fix issue where websockets streams would stream all data after timeout
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update wheel from 0.37.1 to 0.38.4
SQLAlchemy 1.3.24 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update setuptools from 65.4.1 to 65.5.1
wheel 0.37.1 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update mypy from 0.982 to 0.990
wheel 0.37.1 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update sphinxcontrib-spelling from 7.6.1 to 7.7.0
wheel 0.37.1 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update twisted from 22.8.0 to 22.10.0
wheel 0.37.1 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update pytest-env from 0.6.2 to 0.8.1
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update pytest from 7.1.3 to 7.2.0
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update psycopg2-binary from 2.9.4 to 2.9.5
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update psutil from 5.9.2 to 5.9.4
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update uvicorn from 0.18.3 to 0.19.0
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update uvicorn from 0.18.3 to 0.19.0
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update pytz from 2022.4 to 2022.6
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-14
3 years, 6 months ago
Update python-daemon from 2.3.1 to 2.3.2
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <=25.5.0 |
show Affected versions of the Twisted package are vulnerable to Denial of Service due to unbounded resource consumption when decoding DNS names with chained compression pointers. The Name.decode method in src/twisted/names/dns.py enforces no per-message limit on pointer dereferences and resets its visited set for each Question record, while DNSServerFactory processes every record in QDCOUNT without validating it, so a Message containing thousands of questions that all reference a long shared chain of compression pointers forces the parser into millions of redundant traversals. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
Python 3 badge
URL
https://pyup.io/repos/github/irrdnet/irrd/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/irrdnet/irrd/)
Restructured Text
.. image:: https://pyup.io/repos/github/irrdnet/irrd/python-3-shield.svg
:target: https://pyup.io/repos/github/irrdnet/irrd/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/irrdnet/irrd/"><img src="https://pyup.io/repos/github/irrdnet/irrd/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/irrdnet/irrd/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/irrdnet/irrd/
RDoc
{<img src="https://pyup.io/repos/github/irrdnet/irrd/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/irrdnet/irrd/]
pyup.io badge
URL
https://pyup.io/repos/github/irrdnet/irrd/shield.svg
Markdown
[](https://pyup.io/repos/github/irrdnet/irrd/)
Restructured Text
.. image:: https://pyup.io/repos/github/irrdnet/irrd/shield.svg
:target: https://pyup.io/repos/github/irrdnet/irrd/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/irrdnet/irrd/"><img src="https://pyup.io/repos/github/irrdnet/irrd/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/irrdnet/irrd/shield.svg(Updates)!:https://pyup.io/repos/github/irrdnet/irrd/
RDoc
{<img src="https://pyup.io/repos/github/irrdnet/irrd/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/irrdnet/irrd/]