Safety CI > irrdnet/irrd

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

2da84470

test fix

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

37316d07

fix

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

b28390fc

fix

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

d731ac37

fix

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

c6cab803

drop coverag to 6.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

0cbf5b20

drop asgiref to 3.4.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

97b328d5

drop uvicorn to 0.17.0 for 3.6

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

33bc76c9

ordered-set down to 4.0.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

45a1d2bb

Update twine from 3.7.1 to 3.8.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

b8017600

Update sphinx from 4.3.2 to 4.4.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

bb47ba71

Update twisted from 21.7.0 to 22.1.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

ed029a9d

Update coverage from 6.2 to 6.3.1

twisted 21.7.0 has known security vulnerabilities.

Package	Installed	Affected	Info
twisted	21.7.0	<24.7.0rc1	show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.
twisted	21.7.0	>=0.9.4,<22.10.0rc1	show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
twisted	21.7.0	>=11.1,<22.1	show Twisted 22.1 includes a fix for CVE-2022-21712: In affected versions, twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the 'twisted.web.RedirectAgent' and 'twisted.web.BrowserLikeRedirectAgent' functions. There are no known workarounds.
twisted	21.7.0	<24.7.0rc1	show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.
twisted	21.7.0	>=16.3.0,<23.10.0rc1	show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm
twisted	21.7.0	<22.4.0rc1	show Twisted 22.4.0rc1 includes a fix for CVE-2022-24801: Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the 'twisted.web.http' module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filtering malformed requests by other means, such as configurating an upstream proxy. https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

b04b38be

Update pytest from 6.2.5 to 7.0.1

twisted 21.7.0 has known security vulnerabilities.

Package	Installed	Affected	Info
twisted	21.7.0	<24.7.0rc1	show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.
twisted	21.7.0	>=0.9.4,<22.10.0rc1	show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
twisted	21.7.0	>=11.1,<22.1	show Twisted 22.1 includes a fix for CVE-2022-21712: In affected versions, twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the 'twisted.web.RedirectAgent' and 'twisted.web.BrowserLikeRedirectAgent' functions. There are no known workarounds.
twisted	21.7.0	<24.7.0rc1	show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.
twisted	21.7.0	>=16.3.0,<23.10.0rc1	show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm
twisted	21.7.0	<22.4.0rc1	show Twisted 22.4.0rc1 includes a fix for CVE-2022-24801: Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the 'twisted.web.http' module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filtering malformed requests by other means, such as configurating an upstream proxy. https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

c6021ad6

Update alembic from 1.7.5 to 1.7.6

twisted 21.7.0 has known security vulnerabilities.

Package	Installed	Affected	Info
twisted	21.7.0	<24.7.0rc1	show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.
twisted	21.7.0	>=0.9.4,<22.10.0rc1	show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
twisted	21.7.0	>=11.1,<22.1	show Twisted 22.1 includes a fix for CVE-2022-21712: In affected versions, twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the 'twisted.web.RedirectAgent' and 'twisted.web.BrowserLikeRedirectAgent' functions. There are no known workarounds.
twisted	21.7.0	<24.7.0rc1	show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.
twisted	21.7.0	>=16.3.0,<23.10.0rc1	show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm
twisted	21.7.0	<22.4.0rc1	show Twisted 22.4.0rc1 includes a fix for CVE-2022-24801: Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the 'twisted.web.http' module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filtering malformed requests by other means, such as configurating an upstream proxy. https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq

pyup-scheduled-update-2022-02-14

3 years, 3 months ago

b89371c5

Update asgiref from 3.4.1 to 3.5.0

twisted 21.7.0 has known security vulnerabilities.

Package	Installed	Affected	Info
twisted	21.7.0	<24.7.0rc1	show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.
twisted	21.7.0	>=0.9.4,<22.10.0rc1	show Twisted 22.10.0rc1 includes a fix for CVE-2022-39348: NameVirtualHost Host header injection. https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
twisted	21.7.0	>=11.1,<22.1	show Twisted 22.1 includes a fix for CVE-2022-21712: In affected versions, twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the 'twisted.web.RedirectAgent' and 'twisted.web.BrowserLikeRedirectAgent' functions. There are no known workarounds.
twisted	21.7.0	<24.7.0rc1	show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.
twisted	21.7.0	>=16.3.0,<23.10.0rc1	show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm
twisted	21.7.0	<22.4.0rc1	show Twisted 22.4.0rc1 includes a fix for CVE-2022-24801: Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the 'twisted.web.http' module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filtering malformed requests by other means, such as configurating an upstream proxy. https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq