Safety CI > scieloorg/opac_ssm

snyk-fix-4963d0ed17641df777bcc9563b50ddd7

2 years, 1 month ago

5bcb732c

fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning

No dependencies with known security vulnerabilities.

pyup-update-grpcio-health-checking-1.15.0-to-1.55.0

2 years, 1 month ago

21f66a4e

Update grpcio-health-checking from 1.15.0 to 1.55.0

requests 2.20.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.20.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.20.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.20.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.20.1

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.20.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.20.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-update-grpcio-tools-1.15.0-to-1.55.0

2 years, 1 month ago

6892ae74

Update grpcio-tools from 1.15.0 to 1.55.0

requests 2.20.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.20.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.20.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.20.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.20.1

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.20.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.20.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-update-grpcio-1.15.0-to-1.55.0

2 years, 1 month ago

c2a3cf7b

Update grpcio from 1.15.0 to 1.55.0

requests 2.20.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.20.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.20.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.20.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.20.1

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.20.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.20.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-update-requests-2.20.1-to-2.31.0

2 years, 1 month ago

5839be4e

Update requests from 2.20.1 to 2.31.0

No dependencies with known security vulnerabilities.

dependabot/pip/requests-2.31.0

2 years, 1 month ago

716d42d6

Bump requests from 2.20.1 to 2.31.0 Bumps [requests](https://github.com/psf/requests) from 2.20.1 t

No dependencies with known security vulnerabilities.

pyup-update-grpcio-health-checking-1.15.0-to-1.54.2

2 years, 1 month ago

d3b742fc

Update grpcio-health-checking from 1.15.0 to 1.54.2

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.15.0-to-1.54.2

2 years, 1 month ago

15f824e1

Update grpcio-tools from 1.15.0 to 1.54.2

No dependencies with known security vulnerabilities.

pyup-update-grpcio-1.15.0-to-1.54.2

2 years, 1 month ago

d5a96680

Update grpcio from 1.15.0 to 1.54.2

No dependencies with known security vulnerabilities.

pyup-update-requests-2.20.1-to-2.30.0

2 years, 1 month ago

82b9f30b

Update requests from 2.20.1 to 2.30.0

No dependencies with known security vulnerabilities.

pyup-update-coverage-4.4.2-to-7.2.5

2 years, 2 months ago

778fe736

Update coverage from 4.4.2 to 7.2.5

No dependencies with known security vulnerabilities.

pyup-update-coverage-4.4.2-to-7.2.4

2 years, 2 months ago

3899e047

Update coverage from 4.4.2 to 7.2.4

No dependencies with known security vulnerabilities.

pyup-update-requests-2.20.1-to-2.29.0

2 years, 2 months ago

99b08a12

Update requests from 2.20.1 to 2.29.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-health-checking-1.15.0-to-1.54.0

2 years, 2 months ago

14aa3194

Update grpcio-health-checking from 1.15.0 to 1.54.0

No dependencies with known security vulnerabilities.

pyup-update-grpcio-tools-1.15.0-to-1.54.0

2 years, 2 months ago

b7cf12e1

Update grpcio-tools from 1.15.0 to 1.54.0

No dependencies with known security vulnerabilities.

scieloorg/opac_ssm_api