Safety CI > jberends/requirements

pyup-update-asgiref-3.5.2-to-3.7.2

2 years, 1 month ago

Update asgiref from 3.5.2 to 3.7.2

redis 4.3.6, wheel 0.37.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
redis	4.3.6	>=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4	show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
pydantic	1.9.2	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.9.2	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pydantic	1.9.2	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
requests	2.28.2	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.28.2	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.28.2	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
django-allauth	0.51.0	<0.63.6	show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information.
django-allauth	0.51.0	<0.54.0	show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt.
django-allauth	0.51.0	<65.3.0	show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations.
django-allauth	0.51.0	<0.63.3	show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability.

pyup-update-asgiref-3.5.2-to-3.7.1

2 years, 1 month ago

742e4471

Update asgiref from 3.5.2 to 3.7.1

redis 4.3.6, wheel 0.37.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
redis	4.3.6	>=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4	show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
pydantic	1.9.2	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.9.2	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pydantic	1.9.2	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
requests	2.28.2	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.28.2	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.28.2	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
django-allauth	0.51.0	<0.63.6	show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information.
django-allauth	0.51.0	<0.54.0	show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt.
django-allauth	0.51.0	<65.3.0	show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations.
django-allauth	0.51.0	<0.63.3	show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability.

pyup-update-asgiref-3.5.2-to-3.7.0

2 years, 1 month ago

a9f87ec1

Update asgiref from 3.5.2 to 3.7.0

redis 4.3.6, wheel 0.37.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
redis	4.3.6	>=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4	show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
pydantic	1.9.2	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.9.2	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pydantic	1.9.2	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
requests	2.28.2	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.28.2	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.28.2	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
django-allauth	0.51.0	<0.63.6	show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information.
django-allauth	0.51.0	<0.54.0	show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt.
django-allauth	0.51.0	<65.3.0	show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations.
django-allauth	0.51.0	<0.63.3	show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability.

pyup-update-django-autoslug-1.9.8-to-1.9.9

2 years, 2 months ago

5a89965e

Update django-autoslug from 1.9.8 to 1.9.9

redis 4.3.6, wheel 0.37.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
redis	4.3.6	>=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4	show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
pydantic	1.9.2	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.9.2	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pydantic	1.9.2	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
django-allauth	0.51.0	<0.63.6	show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information.
django-allauth	0.51.0	<0.54.0	show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt.
django-allauth	0.51.0	<65.3.0	show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations.
django-allauth	0.51.0	<0.63.3	show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability.

pyup-update-semver-2.13.0-to-3.0.0

2 years, 2 months ago

e7009a65

Update semver from 2.13.0 to 3.0.0

redis 4.3.6, wheel 0.37.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
redis	4.3.6	>=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4	show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
pydantic	1.9.2	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.9.2	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pydantic	1.9.2	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
django-allauth	0.51.0	<0.63.6	show In Django-allauth, a vulnerability allows attackers to inject arbitrary JavaScript into the login page when configuring the Facebook provider to use the `js_sdk` method, potentially compromising user sessions or stealing sensitive information.
django-allauth	0.51.0	<0.54.0	show Django-allauth 0.54.0 includes a security fix: Even when account enumeration prevention was turned on, it was possible for an attacker to infer whether or not a given account exists based upon the response time of an authentication attempt.
django-allauth	0.51.0	<65.3.0	show Affected versions of allauth are vulnerable to account enumeration through timing attacks (CWE-203). This vulnerability allows attackers to determine the existence of user accounts by measuring response times during email/password authentication attempts. The issue resides in the AuthenticationBackend._authenticate_by_email method, which did not mitigate timing discrepancies. Exploitation can be performed remotely with high feasibility. Users should update to the latest version of allauth to apply the implemented timing attack mitigations.
django-allauth	0.51.0	<0.63.3	show Affected versions of Django-allauth are vulnerable to CSRF and replay attacks in the SAML login flow. RelayStatewas used to keep track of whether or not the login flow was IdP or SP initiated. As RelayState is a separate field, not part of the SAMLResponse payload, it was not signed, causing the vulnerability.

pyup-update-channels-redis-3.4.0-to-4.1.0

2 years, 3 months ago

b333d0dd

Update channels-redis from 3.4.0 to 4.1.0

redis 4.3.6, wheel 0.37.1 and pydantic 1.9.2 have known security vulnerabilities.

Package	Installed	Affected	Info
redis	4.3.6	>=4.5.0,<4.5.4 , >=4.2.0rc1,<4.4.4	show Redis 4.4.4 and 4.5.4 include a fix for CVE-2023-28859: Redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. https://github.com/advisories/GHSA-8fww-64cx-x8p5
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
pydantic	1.9.2	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.9.2	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pydantic	1.9.2	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5

pyup-update-django-environ-0.9.0-to-0.10.0

2 years, 3 months ago

b263392f

Update django-environ from 0.9.0 to 0.10.0