Safety CI > vertexproject/vtx-base-image

pyup-update-types-python-dateutil-2.8.19.14-to-2.9.0.20240821

1 year, 12 months ago

9f73715b

Update types-python-dateutil from 2.8.19.14 to 2.9.0.20240821

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-aiohttp-3.10.0-to-3.10.5

1 year, 12 months ago

0098504c

Update aiohttp from 3.10.0 to 3.10.5

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-aiohappyeyeballs-2.3.7-to-2.4.0

2 years ago

dd2524f3

Update aiohappyeyeballs from 2.3.7 to 2.4.0

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-aiohttp-3.10.0-to-3.10.4

2 years ago

b2d5cdcb

Update aiohttp from 3.10.0 to 3.10.4

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

master

2 years ago

1aa512b9

Update cpe from 1.2.1 to 1.3.0 (#699)

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

master

2 years ago

453e5a80

Update aiohappyeyeballs from 2.3.4 to 2.3.7 (#704)

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-aiohappyeyeballs-2.3.4-to-2.3.7

2 years ago

2ef7d1c3

Update aiohappyeyeballs from 2.3.4 to 2.3.7

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-xxhash-3.4.1-to-3.5.0

2 years ago

7d02756c

Update xxhash from 3.4.1 to 3.5.0

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-aiohappyeyeballs-2.3.4-to-2.3.6

2 years ago

8a382c48

Update aiohappyeyeballs from 2.3.4 to 2.3.6

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-simplejson-3.19.2-to-3.19.3

2 years ago

258a7440

Update simplejson from 3.19.2 to 3.19.3

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-lark-1.1.9-to-1.2.2

2 years ago

5550bc9b

Update lark from 1.1.9 to 1.2.2

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-soupsieve-2.5-to-2.6

2 years ago

cb4926c9

Update soupsieve from 2.5 to 2.6

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-cpe-1.2.1-to-1.3.0

2 years ago

101b01cc

Update cpe from 1.2.1 to 1.3.0

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-lark-1.1.9-to-1.2.1

2 years ago

a314d9fb

Update lark from 1.1.9 to 1.2.1

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

pyup-update-aiohttp-3.10.0-to-3.10.3

2 years ago

a6286d2c

Update aiohttp from 3.10.0 to 3.10.3

pyOpenSSL 24.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pyOpenSSL	24.1.0	>=22.0.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.
pyOpenSSL	24.1.0	>=0.14.0,<26.0.0	show Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.

Package

Installed

Affected

Info

pyOpenSSL

24.1.0

>=22.0.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Classic Buffer Overflow due to missing length validation on DTLS cookie values returned by a user-provided callback. The vulnerability is in the DTLS cookie generation path that uses set_cookie_generate_callback, where pyOpenSSL passes the callback’s return value into an OpenSSL-provided buffer without rejecting values longer than 256 bytes.

pyOpenSSL

24.1.0

>=0.14.0,<26.0.0

show

Affected versions of the pyOpenSSL package are vulnerable to Improper Input Validation due to a failure to securely handle exceptions in a user-supplied callback. The set_tlsext_servername_callback API accepts a callback that, in affected versions, allows an unhandled exception to cause the TLS connection to be accepted instead of rejected, creating a fail-open condition in any security-sensitive logic implemented in that callback.