MarcoMuellner / soccerbot

MIT License
1 stars 1 forks source link

[Snyk] Fix for 19 vulnerabilities #104

Open snyk-bot opened 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `pip` dependencies of this project.

Changes included in this PR

⚠️ Warning ``` requests 2.20.0 has requirement urllib3<1.25,>=1.21.1, but you have urllib3 1.26.6. praw 6.0.0 requires update-checker, which is not installed. gitdb2 4.0.2 requires gitdb, which is not installed. ```

Vulnerabilities that will be fixed

By pinning:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
low severity 369/1000
Why? Has a fix available, CVSS 3.1
Directory Traversal
SNYK-PYTHON-DJANGO-1066259
django:
2.1 -> 2.2.18
No No Known Exploit
low severity 379/1000
Why? Has a fix available, CVSS 3.3
Directory Traversal
SNYK-PYTHON-DJANGO-1279042
django:
2.1 -> 2.2.18
No No Known Exploit
high severity 579/1000
Why? Has a fix available, CVSS 7.3
HTTP Header Injection
SNYK-PYTHON-DJANGO-1290072
django:
2.1 -> 2.2.18
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Directory Traversal
SNYK-PYTHON-DJANGO-1298665
django:
2.1 -> 2.2.18
No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9
Uncontrolled Memory Consumption
SNYK-PYTHON-DJANGO-173679
django:
2.1 -> 2.2.18
No No Known Exploit
low severity 334/1000
Why? Has a fix available, CVSS 2.4
Cross-site Scripting (XSS)
SNYK-PYTHON-DJANGO-174885
django:
2.1 -> 2.2.18
No No Known Exploit
high severity 579/1000
Why? Has a fix available, CVSS 7.3
Man-in-the-Middle (MitM)
SNYK-PYTHON-DJANGO-451300
django:
2.1 -> 2.2.18
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Denial of Service (DoS)
SNYK-PYTHON-DJANGO-456540
django:
2.1 -> 2.2.18
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Denial of Service (DoS)
SNYK-PYTHON-DJANGO-456541
django:
2.1 -> 2.2.18
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Denial of Service (DoS)
SNYK-PYTHON-DJANGO-456542
django:
2.1 -> 2.2.18
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
SQL Injection
SNYK-PYTHON-DJANGO-456566
django:
2.1 -> 2.2.18
No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3
Privilege Escalation
SNYK-PYTHON-DJANGO-536439
django:
2.1 -> 2.2.18
No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9
Information Exposure
SNYK-PYTHON-DJANGO-72562
django:
2.1 -> 2.2.18
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3
Content Spoofing
SNYK-PYTHON-DJANGO-72888
django:
2.1 -> 2.2.18
No No Known Exploit
critical severity 704/1000
Why? Has a fix available, CVSS 9.8
Information Exposure
SNYK-PYTHON-REQUESTS-72435
requests:
2.19.1 -> 2.20
No No Known Exploit
high severity 599/1000
Why? Has a fix available, CVSS 7.7
HTTP Header Injection
SNYK-PYTHON-URLLIB3-1014645
urllib3:
1.23 -> 1.25.9
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-URLLIB3-1533435
urllib3:
1.23 -> 1.25.9
No No Known Exploit
high severity 794/1000
Why? Mature exploit, Has a fix available, CVSS 7.3
CRLF injection
SNYK-PYTHON-URLLIB3-174323
urllib3:
1.23 -> 1.25.9
No Mature
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Improper Certificate Validation
SNYK-PYTHON-URLLIB3-174464
urllib3:
1.23 -> 1.25.9
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the effected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic