Safety CI > wherculano/curso-django

pyup-update-sentry-sdk-1.12.1-to-1.13.0

3 years, 3 months ago

f4638fbd

Update sentry-sdk from 1.12.1 to 1.13.0

No dependencies with known security vulnerabilities.

pyup-update-urllib3-1.26.13-to-1.26.14

3 years, 3 months ago

5f9f8afa

Update urllib3 from 1.26.13 to 1.26.14

No dependencies with known security vulnerabilities.

pyup-update-setuptools-65.6.3-to-65.7.0

3 years, 3 months ago

61723942

Update setuptools from 65.6.3 to 65.7.0

No dependencies with known security vulnerabilities.

pyup-update-botocore-1.29.45-to-1.29.48

3 years, 3 months ago

323473aa

Update botocore from 1.29.45 to 1.29.48

No dependencies with known security vulnerabilities.

pyup-update-boto3-1.26.45-to-1.26.48

3 years, 3 months ago

974049ca

Update boto3 from 1.26.45 to 1.26.48

No dependencies with known security vulnerabilities.

pyup-update-coverage-7.0.3-to-7.0.5

3 years, 3 months ago

12861ecc

Update coverage from 7.0.3 to 7.0.5

No dependencies with known security vulnerabilities.

pyup-update-botocore-1.29.45-to-1.29.47

3 years, 3 months ago

2f0d55fb

Update botocore from 1.29.45 to 1.29.47

No dependencies with known security vulnerabilities.

pyup-update-boto3-1.26.45-to-1.26.47

3 years, 3 months ago

07e6052b

Update boto3 from 1.26.45 to 1.26.47

No dependencies with known security vulnerabilities.

pyup-update-python-decouple-3.6-to-3.7

3 years, 3 months ago

696f6a01

Update python-decouple from 3.6 to 3.7

No dependencies with known security vulnerabilities.

pyup-update-botocore-1.29.45-to-1.29.46

3 years, 3 months ago

dfb1523a

Update botocore from 1.29.45 to 1.29.46

No dependencies with known security vulnerabilities.

pyup-update-boto3-1.26.45-to-1.26.46

3 years, 3 months ago

461293d2

Update boto3 from 1.26.45 to 1.26.46

No dependencies with known security vulnerabilities.

pyup-update-coverage-7.0.3-to-7.0.4

3 years, 3 months ago

655067be

Update coverage from 7.0.3 to 7.0.4

No dependencies with known security vulnerabilities.

pyup-update-packaging-22.0-to-23.0

3 years, 3 months ago

0f199979

Update packaging from 22.0 to 23.0

No dependencies with known security vulnerabilities.

pyup-update-iniconfig-1.1.1-to-2.0.0

3 years, 3 months ago

64cf8624

Update iniconfig from 1.1.1 to 2.0.0

No dependencies with known security vulnerabilities.

pyup-update-botocore-1.28.4-to-1.29.45

3 years, 3 months ago

7d6b1b23

Update botocore from 1.28.4 to 1.29.45

certifi 2022.9.24, setuptools 65.5.0 and certifi 2022.9.24 have known security vulnerabilities.

Package	Installed	Affected	Info
certifi	2022.9.24	<2022.12.07	show Certifi 2022.12.07 includes a fix for CVE-2022-23491: Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
certifi	2022.9.24	>=2021.05.30,<2024.07.04	show Certifi affected versions recognized root certificates from GLOBALTRUST. Certifi patch removes these root certificates from the root store. These certificates are being removed pursuant to an investigation that identified "long-running and unresolved compliance issues" and are also in the process of being removed from Mozilla's trust store.
certifi	2022.9.24	>=1.0.1,<2023.07.22	show Certifi 2023.07.22 includes a fix for CVE-2023-37920: Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7
setuptools	65.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	65.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	65.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
certifi	2022.9.24	<2022.12.07	show Certifi 2022.12.07 includes a fix for CVE-2022-23491: Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
certifi	2022.9.24	>=2021.05.30,<2024.07.04	show Certifi affected versions recognized root certificates from GLOBALTRUST. Certifi patch removes these root certificates from the root store. These certificates are being removed pursuant to an investigation that identified "long-running and unresolved compliance issues" and are also in the process of being removed from Mozilla's trust store.
certifi	2022.9.24	>=1.0.1,<2023.07.22	show Certifi 2023.07.22 includes a fix for CVE-2023-37920: Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7