-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
moto-4.2.12-py2.py3-none-any.whl: 8 vulnerabilities (highest severity is: 8.0) #58
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
Security vulnerability detected by Mend
label
Dec 20, 2023
mend-for-github-com
bot
changed the title
moto-4.2.12-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.5)
moto-4.2.12-py2.py3-none-any.whl: 4 vulnerabilities (highest severity is: 7.5)
Apr 16, 2024
mend-for-github-com
bot
changed the title
moto-4.2.12-py2.py3-none-any.whl: 4 vulnerabilities (highest severity is: 7.5)
moto-4.2.12-py2.py3-none-any.whl: 5 vulnerabilities (highest severity is: 7.5)
May 7, 2024
mend-for-github-com
bot
changed the title
moto-4.2.12-py2.py3-none-any.whl: 5 vulnerabilities (highest severity is: 7.5)
moto-4.2.12-py2.py3-none-any.whl: 6 vulnerabilities (highest severity is: 7.5)
May 7, 2024
mend-for-github-com
bot
changed the title
moto-4.2.12-py2.py3-none-any.whl: 6 vulnerabilities (highest severity is: 7.5)
moto-4.2.12-py2.py3-none-any.whl: 7 vulnerabilities (highest severity is: 7.5)
Jul 9, 2024
mend-for-github-com
bot
changed the title
moto-4.2.12-py2.py3-none-any.whl: 7 vulnerabilities (highest severity is: 7.5)
moto-4.2.12-py2.py3-none-any.whl: 7 vulnerabilities (highest severity is: 8.0)
Sep 8, 2024
mend-for-github-com
bot
changed the title
moto-4.2.12-py2.py3-none-any.whl: 7 vulnerabilities (highest severity is: 8.0)
moto-4.2.12-py2.py3-none-any.whl: 8 vulnerabilities (highest severity is: 8.0)
Oct 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
0 participants
Vulnerable Library - moto-4.2.12-py2.py3-none-any.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-46136
Vulnerable Library - Werkzeug-2.2.3-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/f6/f8/9da63c1617ae2a1dec2fbf6412f3a0cfe9d4ce029eccbda6e1e4258ca45f/Werkzeug-2.2.3-py3-none-any.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.
Publish Date: 2023-10-24
URL: CVE-2023-46136
CVSS 3 Score Details (8.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-hrfv-mqp8-q5rw
Release Date: 2023-10-24
Fix Resolution: werkzeug - 2.3.8,3.0.1
CVE-2024-6119
Vulnerable Library - cryptography-41.0.7-cp37-abi3-manylinux_2_28_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/62/bd/69628ab50368b1beb900eb1de5c46f8137169b75b2458affe95f2f470501/cryptography-41.0.7-cp37-abi3-manylinux_2_28_x86_64.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Found in base branch: main
Vulnerability Details
Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an invalid memory
address resulting in abnormal termination of the application process.
Impact summary: Abnormal termination of an application can a cause a denial of
service.
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an
otherName
subject alternative name of anX.509 certificate. This may result in an exception that terminates the
application program.
Note that basic certificate chain validation (signatures, dates, ...) is not
affected, the denial of service can occur only when the application also
specifies an expected DNS name, Email address or IP address.
TLS servers rarely solicit client certificates, and even when they do, they
generally don't perform a name check against a reference identifier (expected
identity), but rather extract the presented identity after checking the
certificate chain. So TLS servers are generally not affected and the severity
of the issue is Moderate.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Publish Date: 2024-09-03
URL: CVE-2024-6119
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://openssl-library.org/news/secadv/20240903.txt
Release Date: 2024-09-03
Fix Resolution: openssl-3.0.15,openssl-3.1.7,openssl-3.2.3,openssl-3.3.2, cryptography - 43.0.1
CVE-2024-34069
Vulnerable Library - Werkzeug-2.2.3-py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/f6/f8/9da63c1617ae2a1dec2fbf6412f3a0cfe9d4ce029eccbda6e1e4258ca45f/Werkzeug-2.2.3-py3-none-any.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Publish Date: 2024-05-06
URL: CVE-2024-34069
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-2g68-c3qc-8985
Release Date: 2024-05-06
Fix Resolution (Werkzeug): 3.0.3
Direct dependency fix Resolution (moto): 4.2.13
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2024-26130
Vulnerable Library - cryptography-41.0.7-cp37-abi3-manylinux_2_28_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/62/bd/69628ab50368b1beb900eb1de5c46f8137169b75b2458affe95f2f470501/cryptography-41.0.7-cp37-abi3-manylinux_2_28_x86_64.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Found in base branch: main
Vulnerability Details
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if
pkcs12.serialize_key_and_certificates
is called with both a certificate whose public key did not match the provided private key and anencryption_algorithm
withhmac_hash
set (viaPrivateFormat.PKCS12.encryption_builder().hmac_hash(...)
, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which aValueError
is properly raised.Publish Date: 2024-02-21
URL: CVE-2024-26130
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-6vqw-3v5j-54x4
Release Date: 2024-02-21
Fix Resolution (cryptography): 42.0.4
Direct dependency fix Resolution (moto): 4.2.13
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2023-50782
Vulnerable Library - cryptography-41.0.7-cp37-abi3-manylinux_2_28_x86_64.whl
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/62/bd/69628ab50368b1beb900eb1de5c46f8137169b75b2458affe95f2f470501/cryptography-41.0.7-cp37-abi3-manylinux_2_28_x86_64.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Found in base branch: main
Vulnerability Details
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Publish Date: 2024-02-05
URL: CVE-2023-50782
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-3ww4-gg4f-jr7f
Release Date: 2024-02-05
Fix Resolution (cryptography): 42.0.0
Direct dependency fix Resolution (moto): 4.2.13
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2024-34064
Vulnerable Library - Jinja2-3.1.2-py3-none-any.whl
A very fast and expressive template engine.
Library home page: https://files.pythonhosted.org/packages/bc/c3/f068337a370801f372f2f8f6bad74a5c140f6fda3d9de154052708dd3c65/Jinja2-3.1.2-py3-none-any.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Found in base branch: main
Vulnerability Details
Jinja is an extensible templating engine. The
xmlattr
filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces,/
,>
, or=
, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of thexmlattr
filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe. This vulnerability is fixed in 3.1.4.Publish Date: 2024-05-06
URL: CVE-2024-34064
CVSS 3 Score Details (5.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-h75v-3vvj-5mfj
Release Date: 2024-05-06
Fix Resolution: Jinja2 - 3.1.4
CVE-2024-22195
Vulnerable Library - Jinja2-3.1.2-py3-none-any.whl
A very fast and expressive template engine.
Library home page: https://files.pythonhosted.org/packages/bc/c3/f068337a370801f372f2f8f6bad74a5c140f6fda3d9de154052708dd3c65/Jinja2-3.1.2-py3-none-any.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Found in base branch: main
Vulnerability Details
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja
xmlattr
filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.Publish Date: 2024-01-11
URL: CVE-2024-22195
CVSS 3 Score Details (5.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-h5c8-rqwp-cp95
Release Date: 2024-01-11
Fix Resolution: jinja2 - 3.1.3
CVE-2024-5569
Vulnerable Library - zipp-3.15.0-py3-none-any.whl
Backport of pathlib-compatible object wrapper for zip files
Library home page: https://files.pythonhosted.org/packages/5b/fa/c9e82bbe1af6266adf08afb563905eb87cab83fde00a0a08963510621047/zipp-3.15.0-py3-none-any.whl
Path to dependency file: /test-requirements.txt
Path to vulnerable library: /test-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: d956a1877ccb6b6aaf58dd21fa2f3044803ada29
Found in base branch: main
Vulnerability Details
A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the
Path
module in both zipp and zipfile, such asjoinpath
, the overloaded division operator, anditerdir
. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.Publish Date: 2024-07-09
URL: CVE-2024-5569
CVSS 3 Score Details (3.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae
Release Date: 2024-07-09
Fix Resolution (zipp): 3.19.1
Direct dependency fix Resolution (moto): 4.2.13
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: