pyup-update-pytest-env-0.6.2-to-0.8.2
2 years, 9 months ago
Update pytest-env from 0.6.2 to 0.8.2
pylint 2.8.3, paramiko 2.7.2 and requests 2.25.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
| requests | 2.25.1 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.25.1 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.25.1 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.25.1 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
pyup-update-pre-commit-2.13.0-to-3.3.3
2 years, 10 months ago
Update pre-commit from 2.13.0 to 3.3.3
pylint 2.8.3, paramiko 2.7.2 and requests 2.25.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
| requests | 2.25.1 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.25.1 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.25.1 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.25.1 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
pyup-update-pytest-6.2.4-to-7.3.2
2 years, 10 months ago
Update pytest from 6.2.4 to 7.3.2
pylint 2.8.3, paramiko 2.7.2 and requests 2.25.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
| requests | 2.25.1 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.25.1 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.25.1 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.25.1 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
pyup-update-requests-mock-1.9.3-to-1.11.0
2 years, 10 months ago
Update requests-mock from 1.9.3 to 1.11.0
pylint 2.8.3, paramiko 2.7.2 and requests 2.25.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
| requests | 2.25.1 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.25.1 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.25.1 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.25.1 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
pyup-update-coverage-5.5-to-7.2.7
2 years, 10 months ago
Update coverage from 5.5 to 7.2.7
pylint 2.8.3, paramiko 2.7.2 and requests 2.25.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
| requests | 2.25.1 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.25.1 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.25.1 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.25.1 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
pyup-update-paramiko-2.7.2-to-3.2.0
2 years, 10 months ago
Update paramiko from 2.7.2 to 3.2.0
pylint 2.8.3 and requests 2.25.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| requests | 2.25.1 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.25.1 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.25.1 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.25.1 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
pyup-update-pytest-cov-2.12.1-to-4.1.0
2 years, 10 months ago
Update pytest-cov from 2.12.1 to 4.1.0
pylint 2.8.3, paramiko 2.7.2 and requests 2.25.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
| requests | 2.25.1 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.25.1 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.25.1 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.25.1 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
pyup-update-coverage-5.5-to-7.2.6
2 years, 10 months ago
Update coverage from 5.5 to 7.2.6
pylint 2.8.3, paramiko 2.7.2 and requests 2.25.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
| requests | 2.25.1 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.25.1 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
| requests | 2.25.1 | <2.33.0 |
show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content. |
| requests | 2.25.1 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
pyup-update-requests-2.25.1-to-2.31.0
2 years, 10 months ago
Update requests from 2.25.1 to 2.31.0
pylint 2.8.3 and paramiko 2.7.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
dependabot/pip/requests-2.31.0
2 years, 10 months ago
![@dependabot[bot]](https://avatars3.githubusercontent.com/u/49699333?v=3&s=32){kind=small}
Bump requests from 2.25.1 to 2.31.0
Bumps [requests](https://github.com/psf/requests) from 2.25.1 t
pylint 2.8.3 and paramiko 2.7.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
pyup-update-pre-commit-2.13.0-to-3.3.2
2 years, 10 months ago
Update pre-commit from 2.13.0 to 3.3.2
pylint 2.8.3 and paramiko 2.7.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
pyup-update-pylint-2.8.3-to-2.17.4
2 years, 11 months ago
Update pylint from 2.8.3 to 2.17.4
paramiko 2.7.2 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
pyup-update-requests-2.25.1-to-2.30.0
2 years, 11 months ago
Update requests from 2.25.1 to 2.30.0
pylint 2.8.3 and paramiko 2.7.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
pyup-update-pre-commit-2.13.0-to-3.3.1
2 years, 11 months ago
Update pre-commit from 2.13.0 to 3.3.1
pylint 2.8.3 and paramiko 2.7.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
pyup-update-pre-commit-2.13.0-to-3.3.0
2 years, 11 months ago
Update pre-commit from 2.13.0 to 3.3.0
pylint 2.8.3 and paramiko 2.7.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pylint | 2.8.3 | <2.13.0 |
show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322 |
| paramiko | 2.7.2 | <3.4.0 |
show Paramiko 3.4.0 has been released to fix vulnerabilities affecting encrypt-then-MAC digest algorithms in tandem with CBC ciphers, and ChaCha20-poly1305. The fix requires cooperation from both ends of the connection, making it effective when the remote end is OpenSSH >= 9.6 and configured to use the new “strict kex” mode. For further details, refer to the official Paramiko documentation or GitHub repository. https://github.com/advisories/GHSA-45x7-px36-x8w8 |
| paramiko | 2.7.2 | >=0,<2.9.3 , >=2.10.0,<2.10.1 |
show In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
Python 3 badge
URL
https://pyup.io/repos/github/mytardis/mydata-python/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/mytardis/mydata-python/)
Restructured Text
.. image:: https://pyup.io/repos/github/mytardis/mydata-python/python-3-shield.svg
:target: https://pyup.io/repos/github/mytardis/mydata-python/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/mytardis/mydata-python/"><img src="https://pyup.io/repos/github/mytardis/mydata-python/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/mytardis/mydata-python/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/mytardis/mydata-python/
RDoc
{<img src="https://pyup.io/repos/github/mytardis/mydata-python/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/mytardis/mydata-python/]
pyup.io badge
URL
https://pyup.io/repos/github/mytardis/mydata-python/shield.svg
Markdown
[](https://pyup.io/repos/github/mytardis/mydata-python/)
Restructured Text
.. image:: https://pyup.io/repos/github/mytardis/mydata-python/shield.svg
:target: https://pyup.io/repos/github/mytardis/mydata-python/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/mytardis/mydata-python/"><img src="https://pyup.io/repos/github/mytardis/mydata-python/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/mytardis/mydata-python/shield.svg(Updates)!:https://pyup.io/repos/github/mytardis/mydata-python/
RDoc
{<img src="https://pyup.io/repos/github/mytardis/mydata-python/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/mytardis/mydata-python/]