pyup-update-pylint-2.4.4-to-4.0.6
1 month, 1 week ago
Update pylint from 2.4.4 to 4.0.6
pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-pytest-5.4.1-to-9.1.0
1 month, 1 week ago
Update pytest from 5.4.1 to 9.1.0
pydantic 1.4, pyyaml 5.3.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-filelock-3.0.12-to-3.29.4
1 month, 1 week ago
Update filelock from 3.0.12 to 3.29.4
pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
pyup-update-filelock-3.0.12-to-3.29.1
1 month, 2 weeks ago
Update filelock from 3.0.12 to 3.29.1
pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
pyup-pin-numpy-2.4.6
2 months ago
Pin numpy to latest version 2.4.6
pydantic 1.4, pyyaml 5.3.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-black-19.10b0-to-26.5.1
2 months ago
Update black from 19.10b0 to 26.5.1
pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-black-19.10b0-to-26.5.0
2 months ago
Update black from 19.10b0 to 26.5.0
pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-pin-numpy-2.4.5
2 months, 1 week ago
Pin numpy to latest version 2.4.5
pydantic 1.4, pyyaml 5.3.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-pydantic-1.4-to-2.13.4
2 months, 2 weeks ago
Update pydantic from 1.4 to 2.13.4
pyyaml 5.3.1, yamale 2.0.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-zarr-2.4.0-to-3.2.1
2 months, 2 weeks ago
Update zarr from 2.4.0 to 3.2.1
pydantic 1.4, pyyaml 5.3.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-zarr-2.4.0-to-3.2.0
2 months, 3 weeks ago
Update zarr from 2.4.0 to 3.2.0
pydantic 1.4, pyyaml 5.3.1 and 4 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-pydantic-1.4-to-2.13.3
3 months ago
Update pydantic from 1.4 to 2.13.3
pyyaml 5.3.1, yamale 2.0.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-filelock-3.0.12-to-3.29.0
3 months ago
Update filelock from 3.0.12 to 3.29.0
pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pydantic | 1.4 | <1.10.2 |
show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5 |
| pydantic | 1.4 | <1.10.13 , >=2.0a1,<2.4.0 |
show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673 |
| pydantic | 1.4 | >=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2 |
show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic. |
| pydantic | 1.4 | >=2.0.0,<2.4.0 , <1.10.13 |
show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string. |
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
pyup-update-pydantic-1.4-to-2.13.2
3 months ago
Update pydantic from 1.4 to 2.13.2
pyyaml 5.3.1, yamale 2.0.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
pyup-update-pydantic-1.4-to-2.13.1
3 months, 1 week ago
Update pydantic from 1.4 to 2.13.1
pyyaml 5.3.1, yamale 2.0.1 and 3 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pyyaml | 5.3.1 | >=5.3.1,<5.4 |
show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466 |
| yamale | 2.0.1 | >0 |
show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources. |
| yamale | 2.0.1 | <3.0.8 |
show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8 |
| yamale | 2.0.1 | <4.0.0 |
show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167 |
| pylint | 2.4.4 | >=0,<2.6.1 |
show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| pylint | 2.4.4 | <2.5.0 |
show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules. |
| pylint | 2.4.4 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| pylint | 2.4.4 | <2.7.0 |
show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e |
| black | 19.10b0 | <24.3.0 |
show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. |
| black | 19.10b0 | <26.3.1 |
show Affected versions of the black package are vulnerable to Path Traversal due to unsanitized user input in a cache file name. The vulnerability exists because Black incorporates the --python-cell-magics option value into the cache filename without sanitizing path elements, allowing the computed cache path to escape the intended cache directory. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of the filelock package are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) Race Condition due to a race window between a write-permission check and lock file creation that does not prevent symlink substitution. The flaw is in filelock.SoftFileLock in src/filelock/_soft.py, where _acquire() calls raise_on_not_writable_file() and then performs os.open() on the lock path, allowing the filesystem state to change between the check and the use. |
| filelock | 3.0.12 | <3.20.3 |
show Affected versions of this package are vulnerable to Time-of-Check Time-of-Use (TOCTOU) Race Condition. The file locking mechanism in SoftFileLock._acquire() performs permission validation before file creation without using the O_NOFOLLOW flag, leading to a race window where attackers with local access can create symlinks that redirect lock operations to arbitrary files. An attacker can exploit this vulnerability by creating a malicious symlink during the brief window between permission check and file creation, causing the lock to operate on unintended target files and potentially enabling unauthorized access or file corruption. |
| filelock | 3.0.12 | <3.20.1 |
show Affected versions of this package are vulnerable to a TOCTOU (Time-of-Check to Time-of-Use) symlink vulnerability due to improper handling of symlinks during lock file creation. The vulnerability exists because the package does not adequately check for symlink manipulation between the time the lock file path is checked and the time it is used. An attacker can exploit this vulnerability by creating a malicious symlink, potentially leading to unauthorized access or modification of files, which could compromise the integrity and security of the system. |
Python 3 badge
URL
https://pyup.io/repos/github/mlsploit/mlsploit-py/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/mlsploit/mlsploit-py/)
Restructured Text
.. image:: https://pyup.io/repos/github/mlsploit/mlsploit-py/python-3-shield.svg
:target: https://pyup.io/repos/github/mlsploit/mlsploit-py/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/mlsploit/mlsploit-py/"><img src="https://pyup.io/repos/github/mlsploit/mlsploit-py/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/mlsploit/mlsploit-py/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/mlsploit/mlsploit-py/
RDoc
{<img src="https://pyup.io/repos/github/mlsploit/mlsploit-py/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/mlsploit/mlsploit-py/]
pyup.io badge
URL
https://pyup.io/repos/github/mlsploit/mlsploit-py/shield.svg
Markdown
[](https://pyup.io/repos/github/mlsploit/mlsploit-py/)
Restructured Text
.. image:: https://pyup.io/repos/github/mlsploit/mlsploit-py/shield.svg
:target: https://pyup.io/repos/github/mlsploit/mlsploit-py/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/mlsploit/mlsploit-py/"><img src="https://pyup.io/repos/github/mlsploit/mlsploit-py/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/mlsploit/mlsploit-py/shield.svg(Updates)!:https://pyup.io/repos/github/mlsploit/mlsploit-py/
RDoc
{<img src="https://pyup.io/repos/github/mlsploit/mlsploit-py/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/mlsploit/mlsploit-py/]