Safety CI > mzollin/qr-pirate

master

1 year, 11 months ago

285bd9b2

Merge pull request #220 from mzollin/pyup-update-pillow-9.4.0-to-9.5.0 Update pillow to 9.5.0

requests 2.28.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.28.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
requests	2.28.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

Package

Installed

Affected

Info

requests

2.28.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

requests

2.28.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

pyup-update-pillow-9.4.0-to-9.5.0

1 year, 11 months ago

27ea5197

Merge branch 'master' into pyup-update-pillow-9.4.0-to-9.5.0

requests 2.28.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.28.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
requests	2.28.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

Package

Installed

Affected

Info

requests

2.28.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

requests

2.28.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

dependabot/pip/requests-2.31.0

1 year, 11 months ago

e05de4aa

Bump requests from 2.28.1 to 2.31.0 Bumps [requests](https://github.com/psf/requests) from 2.28.1 t

No dependencies with known security vulnerabilities.

dependabot/pip/requests-2.31.0

1 year, 11 months ago

35c010f1

Bump requests from 2.28.1 to 2.31.0 Bumps [requests](https://github.com/psf/requests) from 2.28.1 t

No dependencies with known security vulnerabilities.

master

1 year, 11 months ago

cd850258

Merge pull request #219 from mzollin/pyup-update-pycoin-0.92.20220529-to-0.92.20230326 Update pycoi

requests 2.28.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.28.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
requests	2.28.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

Package

Installed

Affected

Info

requests

2.28.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

requests

2.28.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

pyup-update-requests-2.28.1-to-2.31.0

1 year, 11 months ago

0d3ad84f

Update requests from 2.28.1 to 2.31.0

No dependencies with known security vulnerabilities.

dependabot/pip/requests-2.31.0

1 year, 11 months ago

6d579629

Bump requests from 2.28.1 to 2.31.0 Bumps [requests](https://github.com/psf/requests) from 2.28.1 t

No dependencies with known security vulnerabilities.

pyup-update-certifi-2022.12.7-to-2023.5.7

1 year, 11 months ago

56a8cc4d

Update certifi from 2022.12.7 to 2023.5.7

No dependencies with known security vulnerabilities.

pyup-update-urllib3-1.26.13-to-2.0.2

1 year, 11 months ago

65e3780d

Update urllib3 from 1.26.13 to 2.0.2

No dependencies with known security vulnerabilities.

pyup-update-requests-2.28.1-to-2.30.0

1 year, 11 months ago

898460bf

Update requests from 2.28.1 to 2.30.0

No dependencies with known security vulnerabilities.

pyup-update-urllib3-1.26.13-to-2.0.1

1 year, 11 months ago

5fe0f6df

Update urllib3 from 1.26.13 to 2.0.1

No dependencies with known security vulnerabilities.

pyup-update-urllib3-1.26.13-to-2.0.0

1 year, 11 months ago

23c33d82

Update urllib3 from 1.26.13 to 2.0.0

No dependencies with known security vulnerabilities.

pyup-update-requests-2.28.1-to-2.29.0

1 year, 11 months ago

3f66c942

Update requests from 2.28.1 to 2.29.0

No dependencies with known security vulnerabilities.

pyup-update-soupsieve-2.3.2.post1-to-2.4.1

2 years ago

b44b4ebc

Update soupsieve from 2.3.2.post1 to 2.4.1

No dependencies with known security vulnerabilities.

pyup-update-beautifulsoup4-4.11.1-to-4.12.2

2 years ago

2ff34b3a

Update beautifulsoup4 from 4.11.1 to 4.12.2

No dependencies with known security vulnerabilities.