eventstream
3 years, 3 months ago
Add parsed_data
wheel 0.37.1, twisted 22.8.0 and SQLAlchemy 1.3.24 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| SQLAlchemy | 1.3.24 | <2.0.0b1 |
show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563 |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update wheel from 0.37.1 to 0.38.2
No dependencies with known security vulnerabilities.
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update setuptools from 65.4.1 to 65.5.1
wheel 0.37.1 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update sphinxcontrib-spelling from 7.6.1 to 7.6.2
wheel 0.37.1 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update twisted from 22.8.0 to 22.10.0
wheel 0.37.1 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update pytest-env from 0.6.2 to 0.8.1
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update pytest from 7.1.3 to 7.2.0
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update psycopg2-binary from 2.9.4 to 2.9.5
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update psutil from 5.9.2 to 5.9.3
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update uvicorn from 0.18.3 to 0.19.0
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update uvicorn from 0.18.3 to 0.19.0
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update pytz from 2022.4 to 2022.6
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
pyup-scheduled-update-2022-11-07
3 years, 3 months ago
Update python-daemon from 2.3.1 to 2.3.2
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
eventstream
3 years, 3 months ago
fix
wheel 0.37.1 and twisted 22.8.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| wheel | 0.37.1 | <0.46.2 |
show Affected versions of the wheel package are vulnerable to Path Traversal due to applying extracted file permissions using an unsanitized archive pathname. The vulnerable logic is in wheel.cli.unpack.unpack (and setuptools._vendor.wheel.cli.unpack.unpack), where the code calls wf.extract(zinfo, destination) but then performs destination.joinpath(zinfo.filename).chmod(permissions) using zinfo.filename directly, allowing dot-dot-slash sequences to escape the intended directory. |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| twisted | 22.8.0 | >=0.9.4,<22.10.0rc1 |
show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647 |
| twisted | 22.8.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| twisted | 22.8.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
pyup-scheduled-update-2022-10-31
3 years, 3 months ago
Update wheel from 0.37.1 to 0.38.0
No dependencies with known security vulnerabilities.
Python 3 badge
URL
https://pyup.io/repos/github/irrdnet/irrd/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/irrdnet/irrd/)
Restructured Text
.. image:: https://pyup.io/repos/github/irrdnet/irrd/python-3-shield.svg
:target: https://pyup.io/repos/github/irrdnet/irrd/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/irrdnet/irrd/"><img src="https://pyup.io/repos/github/irrdnet/irrd/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/irrdnet/irrd/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/irrdnet/irrd/
RDoc
{<img src="https://pyup.io/repos/github/irrdnet/irrd/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/irrdnet/irrd/]
pyup.io badge
URL
https://pyup.io/repos/github/irrdnet/irrd/shield.svg
Markdown
[](https://pyup.io/repos/github/irrdnet/irrd/)
Restructured Text
.. image:: https://pyup.io/repos/github/irrdnet/irrd/shield.svg
:target: https://pyup.io/repos/github/irrdnet/irrd/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/irrdnet/irrd/"><img src="https://pyup.io/repos/github/irrdnet/irrd/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/irrdnet/irrd/shield.svg(Updates)!:https://pyup.io/repos/github/irrdnet/irrd/
RDoc
{<img src="https://pyup.io/repos/github/irrdnet/irrd/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/irrdnet/irrd/]