Safety CI > scieloorg/opac

Docs | Support

scieloorg/opac

Requirements Safety CI

master

7 years, 5 months ago

7544b508

Merge pull request #1024 from patymori/fix-page-title Alteração do cabeçalho da página

Flask-Admin 1.5.2 has known security vulnerabilities.

Package	Installed	Affected	Info
Flask-Admin	1.5.2	>=1.0.8,<1.5.3	show Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. https://github.com/flask-admin/flask-admin/pull/1699

master

7 years, 5 months ago

013a69c0

Merge pull request #1011 from robertatakenaka/tk985_v7 [tk985] Melhorias populate_journal_pages (ca

No dependencies with known security vulnerabilities.

pyup-update-flask-testing-0.6.2-to-0.7.1

7 years, 5 months ago

ea7aedd2

Update flask-testing from 0.6.2 to 0.7.1

No dependencies with known security vulnerabilities.

pyup-update-python-slugify-1.2.4-to-1.2.6

7 years, 5 months ago

293bf155

Update python-slugify from 1.2.4 to 1.2.6

No dependencies with known security vulnerabilities.

master

7 years, 5 months ago

966b7606

Merge pull request #1017 from jfunez/upgrade_requirements Atualização de dependências

No dependencies with known security vulnerabilities.

master

7 years, 5 months ago

4a712404

Merge pull request #1015 from jamilatta/tk1014 Adiciona a capacidade da URL antiga do SciELO respon

Flask 0.12.2 and Flask-Admin 1.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929
Flask-Admin	1.5.0	>=0,<1.5.2	show Affected versions of Flask-Admin are vulnerable to cross-site scripting (XSS) via scheme. https://github.com/flask-admin/flask-admin/commit/0dc5a48fd0a4fdd28172e0bc508373ddb58fc50b
Flask-Admin	1.5.0	>=1.0.8,<1.5.3	show Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. https://github.com/flask-admin/flask-admin/pull/1699

master

7 years, 5 months ago

c6c2eb6d

Merge pull request #1009 from robertatakenaka/tk1008 [tk1008] Corrigir "create_image" que não copia

Flask 0.12.2 and Flask-Admin 1.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929
Flask-Admin	1.5.0	>=0,<1.5.2	show Affected versions of Flask-Admin are vulnerable to cross-site scripting (XSS) via scheme. https://github.com/flask-admin/flask-admin/commit/0dc5a48fd0a4fdd28172e0bc508373ddb58fc50b
Flask-Admin	1.5.0	>=1.0.8,<1.5.3	show Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. https://github.com/flask-admin/flask-admin/pull/1699

pyup-update-python-slugify-1.2.4-to-1.2.6

7 years, 5 months ago

5401b523

Update python-slugify from 1.2.4 to 1.2.6

Flask 0.12.2 and Flask-Admin 1.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929
Flask-Admin	1.5.0	>=0,<1.5.2	show Affected versions of Flask-Admin are vulnerable to cross-site scripting (XSS) via scheme. https://github.com/flask-admin/flask-admin/commit/0dc5a48fd0a4fdd28172e0bc508373ddb58fc50b
Flask-Admin	1.5.0	>=1.0.8,<1.5.3	show Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. https://github.com/flask-admin/flask-admin/pull/1699

pyup-update-xlsxwriter-1.0.2-to-1.1.0

7 years, 5 months ago

a72c28d5

Update xlsxwriter from 1.0.2 to 1.1.0

Flask 0.12.2 and Flask-Admin 1.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929
Flask-Admin	1.5.0	>=0,<1.5.2	show Affected versions of Flask-Admin are vulnerable to cross-site scripting (XSS) via scheme. https://github.com/flask-admin/flask-admin/commit/0dc5a48fd0a4fdd28172e0bc508373ddb58fc50b
Flask-Admin	1.5.0	>=1.0.8,<1.5.3	show Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. https://github.com/flask-admin/flask-admin/pull/1699

master

7 years, 5 months ago

68a998df

Merge pull request #1010 from jamilatta/update_opac_schema_version Atualiza a versão do OPAC schema

Flask 0.12.2 and Flask-Admin 1.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929
Flask-Admin	1.5.0	>=0,<1.5.2	show Affected versions of Flask-Admin are vulnerable to cross-site scripting (XSS) via scheme. https://github.com/flask-admin/flask-admin/commit/0dc5a48fd0a4fdd28172e0bc508373ddb58fc50b
Flask-Admin	1.5.0	>=1.0.8,<1.5.3	show Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. https://github.com/flask-admin/flask-admin/pull/1699

pyup-update-xlsxwriter-1.0.2-to-1.0.9

7 years, 6 months ago

90f88372

Update xlsxwriter from 1.0.2 to 1.0.9

Flask 0.12.2 and Flask-Admin 1.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929
Flask-Admin	1.5.0	>=0,<1.5.2	show Affected versions of Flask-Admin are vulnerable to cross-site scripting (XSS) via scheme. https://github.com/flask-admin/flask-admin/commit/0dc5a48fd0a4fdd28172e0bc508373ddb58fc50b
Flask-Admin	1.5.0	>=1.0.8,<1.5.3	show Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. https://github.com/flask-admin/flask-admin/pull/1699

master

7 years, 6 months ago

f8470317

Merge pull request #1004 from robertatakenaka/tk985_v3 [tk985] Melhorias no procedimento de carga d

Flask 0.12.2 and Flask-Admin 1.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929
Flask-Admin	1.5.0	>=0,<1.5.2	show Affected versions of Flask-Admin are vulnerable to cross-site scripting (XSS) via scheme. https://github.com/flask-admin/flask-admin/commit/0dc5a48fd0a4fdd28172e0bc508373ddb58fc50b
Flask-Admin	1.5.0	>=1.0.8,<1.5.3	show Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL. https://github.com/flask-admin/flask-admin/pull/1699

pyup-update-flask-admin-1.5.0-to-1.5.2

7 years, 6 months ago

b48d00ef

Update flask-admin from 1.5.0 to 1.5.2

Flask 0.12.2 has known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929

pyup-update-xlsxwriter-1.0.2-to-1.0.8

7 years, 6 months ago

2fe98e93

Update xlsxwriter from 1.0.2 to 1.0.8

Flask 0.12.2 has known security vulnerabilities.

Package	Installed	Affected	Info
Flask	0.12.2	<3.1.3	show Affected versions of the Flask package are vulnerable to Information Disclosure due to missing cache-variation headers when the session object is accessed via certain code paths. In Flask’s session handling, accessing flask.session is intended to set a Vary: Cookie response header, but session key-only access patterns (such as using the Python in operator to test for a key without reading or mutating session values) can bypass the logic that adds the header.
Flask	0.12.2	<2.2.5 , >=2.3.0,<2.3.2	show Flask 2.2.5 and 2.3.2 include a fix for CVE-2023-30861: When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches 'Set-Cookie' headers, it may send one client's 'session' cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met: 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets 'session.permanent = True' 3. The application does not access or modify the session at any point during a request. 4. 'SESSION_REFRESH_EACH_REQUEST' enabled (the default). 5. The application does not set a 'Cache-Control' header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the 'Vary: Cookie' header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq
Flask	0.12.2	<0.12.3	show flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Flask	0.12.2	<0.12.3	show Flask 0.12.3 includes a fix for CVE-2019-1010083: Unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. NOTE: this may overlap CVE-2018-1000656. https://github.com/pallets/flask/pull/2695/commits/0e1e9a04aaf29ab78f721cfc79ac2a691f6e3929

pyup-update-xlsxwriter-1.0.2-to-1.0.7

7 years, 6 months ago

6216328f

Update xlsxwriter from 1.0.2 to 1.0.7

No dependencies with known security vulnerabilities.

older