Safety CI > vertexproject/vtx-base-image

pyup-update-typing-extensions-4.5.0-to-4.6.1

2 years, 9 months ago

20f1c15d

Update typing-extensions from 4.5.0 to 4.6.1

requests 2.29.0 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.29.0	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.29.0	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.29.0	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.29.0

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.29.0

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.29.0

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-update-requests-2.29.0-to-2.31.0

2 years, 9 months ago

f2eb0e30

Update requests from 2.29.0 to 2.31.0

No dependencies with known security vulnerabilities.

pyup-update-typing-extensions-4.5.0-to-4.6.0

2 years, 9 months ago

e7296c57

Update typing-extensions from 4.5.0 to 4.6.0

requests 2.29.0 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.29.0	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.29.0	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.29.0	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.29.0

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.29.0

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.29.0

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-update-fastjsonschema-2.16.3-to-2.17.1

2 years, 9 months ago

d8a26cf1

Update fastjsonschema from 2.16.3 to 2.17.1

No dependencies with known security vulnerabilities.

pyup-update-antlr4-python3-runtime-4.9.3-to-4.13.0

2 years, 9 months ago

80092700

Update antlr4-python3-runtime from 4.9.3 to 4.13.0

No dependencies with known security vulnerabilities.

pyup-update-fastjsonschema-2.16.3-to-2.17.0

2 years, 9 months ago

207da016

Update fastjsonschema from 2.16.3 to 2.17.0

No dependencies with known security vulnerabilities.

pyup-update-pycryptodome-3.17.0-to-3.18.0

2 years, 9 months ago

c7d75a2b

Update pycryptodome from 3.17.0 to 3.18.0

No dependencies with known security vulnerabilities.

pyup-update-scalecodec-1.2.2-to-1.2.5

2 years, 9 months ago

018d4b59

Update scalecodec from 1.2.2 to 1.2.5

No dependencies with known security vulnerabilities.

pyup-update-tornado-6.3.1-to-6.3.2

2 years, 9 months ago

88a26eee

Update tornado from 6.3.1 to 6.3.2

No dependencies with known security vulnerabilities.

pyup-update-scalecodec-1.2.2-to-1.2.4

2 years, 9 months ago

3403e991

Update scalecodec from 1.2.2 to 1.2.4

No dependencies with known security vulnerabilities.

pyup-update-platformdirs-3.5.0-to-3.5.1

2 years, 9 months ago

91fb33fe

Update platformdirs from 3.5.0 to 3.5.1

No dependencies with known security vulnerabilities.

pyup-update-certifi-2022.12.7-to-2023.5.7

2 years, 9 months ago

3628a02a

Update certifi from 2022.12.7 to 2023.5.7

No dependencies with known security vulnerabilities.

pyup-update-scalecodec-1.2.2-to-1.2.3

2 years, 9 months ago

33623142

Update scalecodec from 1.2.2 to 1.2.3

No dependencies with known security vulnerabilities.

master

2 years, 9 months ago

12110696

Merge pull request #357 from vertexproject/feat_remove_known_certs Selectively remove known files f

No dependencies with known security vulnerabilities.

feat_remove_known_certs

2 years, 9 months ago

15b340db

Account for a missing rmlist file and fail

No dependencies with known security vulnerabilities.