pyup-update-channels-redis-3.4.0-to-4.2.0
1 year, 5 months ago
Update channels-redis from 3.4.0 to 4.2.0
redis 4.3.6, wheel 0.37.1 and 7 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Pillow | 9.5.0 | >=2.5.0,<10.0.1 |
show Pillow 10.0.1 updates its C dependency 'libwebp' to 1.3.2 to include a fix for a high-risk vulnerability. https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function. |
| Pillow | 9.5.0 | <10.3.0 |
show Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues. |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code. https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html |
| Pillow | 9.5.0 | <10.0.0 |
show Pillow 10.0.0 includes a fix for CVE-2023-44271: Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. https://github.com/python-pillow/Pillow/pull/7244 |
| pyproj | 3.3.1 | >=2.6.1,<3.6.1 |
show Pyproj 3.6.1 updates its bundled dependency 'libwebp' to include a fix for a high risk vulnerability. Only mac OS X wheels on PyPI were affected. |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| Twisted | 22.10.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| Twisted | 22.10.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| Twisted | 22.10.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-djangorestframework_simplejwt-5.2.2-to-5.3.1
1 year, 6 months ago
Update djangorestframework_simplejwt from 5.2.2 to 5.3.1
redis 4.3.6, wheel 0.37.1 and 7 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Pillow | 9.5.0 | >=2.5.0,<10.0.1 |
show Pillow 10.0.1 updates its C dependency 'libwebp' to 1.3.2 to include a fix for a high-risk vulnerability. https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function. |
| Pillow | 9.5.0 | <10.3.0 |
show Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues. |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code. https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html |
| Pillow | 9.5.0 | <10.0.0 |
show Pillow 10.0.0 includes a fix for CVE-2023-44271: Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. https://github.com/python-pillow/Pillow/pull/7244 |
| pyproj | 3.3.1 | >=2.6.1,<3.6.1 |
show Pyproj 3.6.1 updates its bundled dependency 'libwebp' to include a fix for a high risk vulnerability. Only mac OS X wheels on PyPI were affected. |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| Twisted | 22.10.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| Twisted | 22.10.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| Twisted | 22.10.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-django-appconf-1.0.5-to-1.0.6
1 year, 7 months ago
Update django-appconf from 1.0.5 to 1.0.6
redis 4.3.6, wheel 0.37.1 and 7 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Pillow | 9.5.0 | >=2.5.0,<10.0.1 |
show Pillow 10.0.1 updates its C dependency 'libwebp' to 1.3.2 to include a fix for a high-risk vulnerability. https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function. |
| Pillow | 9.5.0 | <10.3.0 |
show Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues. |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code. https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html |
| Pillow | 9.5.0 | <10.0.0 |
show Pillow 10.0.0 includes a fix for CVE-2023-44271: Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. https://github.com/python-pillow/Pillow/pull/7244 |
| pyproj | 3.3.1 | >=2.6.1,<3.6.1 |
show Pyproj 3.6.1 updates its bundled dependency 'libwebp' to include a fix for a high risk vulnerability. Only mac OS X wheels on PyPI were affected. |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| Twisted | 22.10.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to HTTP Request Smuggling. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. |
| Twisted | 22.10.0 | <24.7.0rc1 |
show Affected versions of Twisted are vulnerable to XSS. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. |
| Twisted | 22.10.0 | >=16.3.0,<23.10.0rc1 |
show Twisted 23.10.0rc1 includes a fix for CVE-2023-46137: Disordered HTTP pipeline response in twisted.web. #NOTE: The data we include in this advisory differs from the publicly available on nist.nvd.gov. As indicated in the project's changelog, the vulnerability was introduced in Twisted 16.3.0. https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-semver-2.13.0-to-3.0.2
1 year, 8 months ago
Update semver from 2.13.0 to 3.0.2
redis 4.3.6, wheel 0.37.1 and 5 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Pillow | 9.5.0 | >=2.5.0,<10.0.1 |
show Pillow 10.0.1 updates its C dependency 'libwebp' to 1.3.2 to include a fix for a high-risk vulnerability. https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function. |
| Pillow | 9.5.0 | <10.3.0 |
show Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues. |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code. https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html |
| Pillow | 9.5.0 | <10.0.0 |
show Pillow 10.0.0 includes a fix for CVE-2023-44271: Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. https://github.com/python-pillow/Pillow/pull/7244 |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-django-redis-5.2.0-to-5.4.0
1 year, 9 months ago
Update django-redis from 5.2.0 to 5.4.0
redis 4.3.6, wheel 0.37.1 and 5 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Pillow | 9.5.0 | >=2.5.0,<10.0.1 |
show Pillow 10.0.1 updates its C dependency 'libwebp' to 1.3.2 to include a fix for a high-risk vulnerability. https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function. |
| Pillow | 9.5.0 | <10.3.0 |
show Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues. |
| Pillow | 9.5.0 | <10.2.0 |
show Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code. https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html |
| Pillow | 9.5.0 | <10.0.0 |
show Pillow 10.0.0 includes a fix for CVE-2023-44271: Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. https://github.com/python-pillow/Pillow/pull/7244 |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-pilkit-2.0-to-3.0
1 year, 9 months ago
Update pilkit from 2.0 to 3.0
redis 4.3.6, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-django-mptt-0.14.0-to-0.15.0
1 year, 9 months ago
Update django-mptt from 0.14.0 to 0.15.0
redis 4.3.6, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-django-environ-0.9.0-to-0.11.2
1 year, 9 months ago
Update django-environ from 0.9.0 to 0.11.2
redis 4.3.6, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-django-environ-0.9.0-to-0.11.1
1 year, 10 months ago
Update django-environ from 0.9.0 to 0.11.1
redis 4.3.6, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-django-environ-0.9.0-to-0.11.0
1 year, 10 months ago
Update django-environ from 0.9.0 to 0.11.0
redis 4.3.6, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-djangorestframework_simplejwt-5.2.2-to-5.3.0
1 year, 10 months ago
Update djangorestframework_simplejwt from 5.2.2 to 5.3.0
redis 4.3.6, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-drf-yasg-1.21.4-to-1.21.7
1 year, 11 months ago
Update drf-yasg from 1.21.4 to 1.21.7
redis 4.3.6, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| PyPDF2 | 2.12.1 | >=2.2.0,<=3.0.1 |
show Pypdf2 is vulnerable to CVE-2023-36464: An attacker may craft a PDF which leads to an infinite loop if '__parse_content_stream' is executed. That is, for example, the case if the user extracted text from such a PDF. Users may modify the line 'while peek not in (b"\r", b"\n")' in 'pypdf/generic/_data_structures.py' to 'while peek not in (b"\r", b"\n", b"")' as a workaround. https://github.com/py-pdf/pypdf/pull/1828 https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-django-redis-5.2.0-to-5.3.0
2 years ago
Update django-redis from 5.2.0 to 5.3.0
redis 4.3.6, wheel 0.37.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-drf-yasg-1.21.4-to-1.21.6
2 years ago
Update drf-yasg from 1.21.4 to 1.21.6
redis 4.3.6, wheel 0.37.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
pyup-update-semver-2.13.0-to-3.0.1
2 years ago
Update semver from 2.13.0 to 3.0.1
redis 4.3.6, wheel 0.37.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| redis | 4.3.6 | >=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4 |
show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5 |
| wheel | 0.37.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| pydantic | 1.9.2 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pydantic | 1.9.2 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.9.2 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| requests | 2.28.2 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.28.2 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.28.2 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| django-allauth | 0.51.0 | <0.63.6 |
show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information. |
| django-allauth | 0.51.0 | <0.54.0 |
show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt. |
| django-allauth | 0.51.0 | <65.3.0 |
show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations. |
| django-allauth | 0.51.0 | <0.63.3 |
show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability. |
Python 3 badge
URL
https://pyup.io/repos/github/jberends/requirements/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/jberends/requirements/)
Restructured Text
.. image:: https://pyup.io/repos/github/jberends/requirements/python-3-shield.svg
:target: https://pyup.io/repos/github/jberends/requirements/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/jberends/requirements/"><img src="https://pyup.io/repos/github/jberends/requirements/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/jberends/requirements/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/jberends/requirements/
RDoc
{<img src="https://pyup.io/repos/github/jberends/requirements/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/jberends/requirements/]
pyup.io badge
URL
https://pyup.io/repos/github/jberends/requirements/shield.svg
Markdown
[](https://pyup.io/repos/github/jberends/requirements/)
Restructured Text
.. image:: https://pyup.io/repos/github/jberends/requirements/shield.svg
:target: https://pyup.io/repos/github/jberends/requirements/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/jberends/requirements/"><img src="https://pyup.io/repos/github/jberends/requirements/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/jberends/requirements/shield.svg(Updates)!:https://pyup.io/repos/github/jberends/requirements/
RDoc
{<img src="https://pyup.io/repos/github/jberends/requirements/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/jberends/requirements/]