prolibre-ch/nobinobi-daily-follow-up
- Repos
- prolibre-ch/nobinobi-daily-follow-up
pyup/scheduled-update-2024-10-07
7 months, 1 week ago
Update coverage from 7.4.4 to 7.6.1
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-10-07
7 months, 1 week ago
Update django-debug-toolbar from 4.3.0 to 4.4.6
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-10-07
7 months, 1 week ago
Update werkzeug from 3.0.2 to 3.0.4
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-10-07
7 months, 1 week ago
Update twine from 5.0.0 to 5.1.1
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-10-07
7 months, 1 week ago
Update cffi from 1.16.0 to 1.17.1
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-10-07
7 months, 1 week ago
Update zest.releaser from 9.1.3 to 9.2.0
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-10-07
7 months, 1 week ago
Update wheel from 0.43.0 to 0.44.0
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-09-30
7 months, 2 weeks ago
Update coverage from 7.4.4 to 7.6.1
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-09-30
7 months, 2 weeks ago
Update werkzeug from 3.0.2 to 3.0.4
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-09-30
7 months, 2 weeks ago
Update django-debug-toolbar from 4.3.0 to 4.4.6
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-09-30
7 months, 2 weeks ago
Update zest.releaser from 9.1.3 to 9.2.0
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-09-30
7 months, 2 weeks ago
Update wheel from 0.43.0 to 0.44.0
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-09-30
7 months, 2 weeks ago
Update twine from 5.0.0 to 5.1.1
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-09-30
7 months, 2 weeks ago
Update cffi from 1.16.0 to 1.17.1
werkzeug 3.0.2, selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| werkzeug | 3.0.2 | <3.0.3 |
show Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are vulnerable to Path Traversal (CWE-22) on Windows systems running Python versions below 3.11. The safe_join() function failed to properly detect certain absolute paths on Windows, allowing attackers to potentially access files outside the intended directory. An attacker could craft special paths starting with "/" that bypass the directory restrictions on Windows systems. The vulnerability exists in the safe_join() function which relied solely on os.path.isabs() for path validation. This is exploitable on Windows systems by passing paths starting with "/" to safe_join(). To remediate, upgrade to the latest version which includes additional path validation checks. NOTE: This vulnerability specifically affects Windows systems running Python versions below 3.11 where ntpath.isabs() behavior differs. |
| werkzeug | 3.0.2 | <3.0.6 |
show Affected versions of Werkzeug are potentially vulnerable to resource exhaustion when parsing file data in forms. Applications using 'werkzeug.formparser.MultiPartParser' to parse 'multipart/form-data' requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
pyup/scheduled-update-2024-09-23
7 months, 3 weeks ago
Update werkzeug from 3.0.2 to 3.0.4
selenium 4.10.0 and selenium 4.10.0 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
| selenium | 4.10.0 | >=0, <4.15.1 |
show Selenium 4.15.1 (Python bindings) include a fix for CVE-2023-5590: NULL Pointer Dereference. https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6 |
Python 3 badge
URL
https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/)
Restructured Text
.. image:: https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/python-3-shield.svg
:target: https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/"><img src="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/
RDoc
{<img src="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/]
pyup.io badge
URL
https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg
Markdown
[](https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/)
Restructured Text
.. image:: https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg
:target: https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/"><img src="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg(Updates)!:https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/
RDoc
{<img src="https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/prolibre-ch/nobinobi-daily-follow-up/]