Safety CI > mlsploit/mlsploit-py

pyup-update-black-19.10b0-to-24.1.0

1 year, 8 months ago

Update black from 19.10b0 to 24.1.0

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-pytest-5.4.1-to-7.4.4

1 year, 9 months ago

1778ce33

Update pytest from 5.4.1 to 7.4.4

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-pydantic-1.4-to-2.5.3

1 year, 9 months ago

c5a7f4fb

Update pydantic from 1.4 to 2.5.3

pyyaml 5.3.1, yamale 2.0.1 and pylint 2.4.4 have known security vulnerabilities.

Package	Installed	Affected	Info
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-black-19.10b0-to-24.1a1

1 year, 10 months ago

680d17ae

Update black from 19.10b0 to 24.1a1

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-pylint-2.4.4-to-3.0.3

1 year, 10 months ago

884146a5

Update pylint from 2.4.4 to 3.0.3

pydantic 1.4, pyyaml 5.3.1 and yamale 2.0.1 have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167

pyup-update-typing-extensions-3.7.4.2-to-4.9.0

1 year, 10 months ago

a4b6a86d

Update typing-extensions from 3.7.4.2 to 4.9.0

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-pydantic-1.4-to-2.5.2

1 year, 10 months ago

c8c54310

Update pydantic from 1.4 to 2.5.2

pyyaml 5.3.1, yamale 2.0.1 and pylint 2.4.4 have known security vulnerabilities.

Package	Installed	Affected	Info
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-pydantic-1.4-to-2.5.1

1 year, 11 months ago

30a72a48

Update pydantic from 1.4 to 2.5.1

pyyaml 5.3.1, yamale 2.0.1 and pylint 2.4.4 have known security vulnerabilities.

Package	Installed	Affected	Info
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-pydantic-1.4-to-2.5.0

1 year, 11 months ago

65720aa6

Update pydantic from 1.4 to 2.5.0

pyyaml 5.3.1, yamale 2.0.1 and pylint 2.4.4 have known security vulnerabilities.

Package	Installed	Affected	Info
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-black-19.10b0-to-23.11.0

1 year, 11 months ago

4ea24f49

Update black from 19.10b0 to 23.11.0

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-filelock-3.0.12-to-3.13.1

1 year, 11 months ago

d5c9d2bc

Update filelock from 3.0.12 to 3.13.1

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-filelock-3.0.12-to-3.13.0

1 year, 11 months ago

842604ce

Update filelock from 3.0.12 to 3.13.0

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-pytest-5.4.1-to-7.4.3

1 year, 11 months ago

1279b5c0

Update pytest from 5.4.1 to 7.4.3

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-black-19.10b0-to-23.10.1

1 year, 11 months ago

eb565ad1

Update black from 19.10b0 to 23.10.1

pydantic 1.4, pyyaml 5.3.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.

pyup-update-pylint-2.4.4-to-3.0.2

1 year, 11 months ago

ab1a2b4f

Update pylint from 2.4.4 to 3.0.2

pydantic 1.4, pyyaml 5.3.1 and yamale 2.0.1 have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167