Safety CI > vertexproject/vtx-base-image

pyup-update-multidict-6.0.5-to-6.1.0

1 year, 7 months ago

ebfd8e82

Update multidict from 6.0.5 to 6.1.0

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyup-update-msgpack-1.0.8-to-1.1.0

1 year, 7 months ago

bc961ead

Update msgpack from 1.0.8 to 1.1.0

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

feat_python311_image

1 year, 7 months ago

771cd9b9

lock in 3.11.10

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyup-update-yarl-1.9.4-to-1.11.1

1 year, 7 months ago

1beec30b

Update yarl from 1.9.4 to 1.11.1

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

feat_python311_image

1 year, 7 months ago

11f3e29b

Add a step to update pip and setuptools

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

feat_python311_image

1 year, 7 months ago

3afd32c8

Test build with python3:11 image

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

revert_python_deb12u2_freeze

1 year, 7 months ago

54f46ea6

Do not use deprecated dockerfile features

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

revert_python_deb12u2_freeze

1 year, 7 months ago

4d9e281c

Revert the python 3.11 deb12u2 pin

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

master

1 year, 7 months ago

7b0b1528

Update more-itertools from 10.4.0 to 10.5.0 (#726)

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

master

1 year, 7 months ago

40f73f6e

Update cffi from 1.17.0 to 1.17.1 (#722)

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyup-update-yarl-1.9.4-to-1.11.0

1 year, 7 months ago

c990d741

Update yarl from 1.9.4 to 1.11.0

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyup-update-yarl-1.9.4-to-1.10.0

1 year, 7 months ago

64cec704

Update yarl from 1.9.4 to 1.10.0

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyup-update-types-python-dateutil-2.8.19.14-to-2.9.0.20240906

1 year, 7 months ago

5e010e19

Update types-python-dateutil from 2.8.19.14 to 2.9.0.20240906

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyup-update-more-itertools-10.4.0-to-10.5.0

1 year, 7 months ago

29c4f684

Update more-itertools from 10.4.0 to 10.5.0

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyup-update-yarl-1.9.4-to-1.9.11

1 year, 7 months ago

6956f876

Update yarl from 1.9.4 to 1.9.11

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.