search

SAML-Toolkits / python3-saml

MIT License
672 stars 302 forks source link

lxml has a vulnerability but we can not update because of python3-saml relies on <4.7.1 #319

Closed brugnara closed 1 year ago

brugnara commented 1 year ago

Hi all.

As I mentioned in the subject of the issue, what I wanted to achieve is to update lxml to the first safe version which is the 4.9.1 but Poetry slams the door telling me I can not do it, and with valid reasons:

 SolverProblemError

  Because python3-saml (1.14.0) depends on lxml (<4.7.1)
   and no versions of python3-saml match >1.14.0,<1.15.0, python3-saml (>=1.14.0,<1.15.0) requires lxml (<4.7.1).
  So, because atoka-revenge depends on both lxml (^4.9.1) and python3-saml (~1.14.0), version solving failed.

Security output.

| lxml    | CVE-2022-2309    |          | 4.7.0             | 4.9.1         | lxml: NULL Pointer                    |
|         |                  |          |                   |               | Dereference in lxml                   |
|         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-2309  |

Am I missing something or do somebody have a suggestion on this, pretty please?

Thank you for considering my request.

koleror commented 1 year ago

Hi! Any news on this topic? Any chance the PR could be merged?

mapapuche commented 1 year ago

Hello, same problem :/

thechad12 commented 1 year ago

Hi - can you please merge this PR? We are facing this issue too.

aquatix commented 1 year ago

We would also really appreciate it if this PR can be merged/issue can be fixed. Running a vulnerable lxml in production does not sit well :)

MatthijsvW commented 1 year ago

Yes please, same here!