search

dbca-wa / sdis

A web based project approval, documentation and reporting system
https://sdis.dbca.wa.gov.au/
8 stars 3 forks source link

[Snyk] Fix for 30 vulnerabilities #156

Closed snyk-bot closed 2 years ago

snyk-bot commented 2 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `pip` dependencies of this project.

Changes included in this PR

⚠️ Warning ``` requests 2.24.0 has requirement urllib3!=1.25.0,!=1.25.1,<1.26,>=1.21.1, but you have urllib3 1.26.5. pipenv 2021.5.29 has requirement pip>=18.0, but you have pip 9.0.3. django-tablib 3.2 requires tablib, which is not installed. django-braces 1.14.0 has requirement Django>=1.11.0, but you have Django 1.6.5. ```

Vulnerabilities that will be fixed

By pinning:
Severity Issue Upgrade Breaking Change Exploit Maturity
medium severity Directory Traversal
SNYK-PYTHON-BABEL-1278589		 babel:
2.8.0 -> 2.9.1
No No Known Exploit
high severity Timing Attack
SNYK-PYTHON-CRYPTOGRAPHY-1022152		 cryptography:
3.0 -> 3.2
No No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-JINJA2-1012994		 jinja2:
2.11.2 -> 2.11.3
No Proof of Concept
high severity Out-of-bounds Read
SNYK-PYTHON-PILLOW-1055461		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Out-of-bounds Read
SNYK-PYTHON-PILLOW-1055462		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
medium severity Out-of-bounds Write
SNYK-PYTHON-PILLOW-1059090		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Out-of-bounds Read
SNYK-PYTHON-PILLOW-1080635		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-PILLOW-1080654		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-PILLOW-1081494		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-PILLOW-1081501		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-PILLOW-1081502		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Heap-based Buffer Overflow
SNYK-PYTHON-PILLOW-1082329		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Insufficient Validation
SNYK-PYTHON-PILLOW-1082750		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-PILLOW-1090584		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-PILLOW-1090586		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-PILLOW-1090587		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-PILLOW-1090588		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Out-of-bounds Read
SNYK-PYTHON-PILLOW-1292150		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Out-of-bounds Read
SNYK-PYTHON-PILLOW-1292151		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
medium severity Buffer Overflow
SNYK-PYTHON-PILLOW-1316216		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-PILLOW-1319443		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
medium severity Out-of-Bounds
SNYK-PYTHON-PILLOW-574573		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
medium severity Out-of-bounds Read
SNYK-PYTHON-PILLOW-574574		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
medium severity Out-of-bounds Read
SNYK-PYTHON-PILLOW-574575		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
medium severity Out-of-bounds Read
SNYK-PYTHON-PILLOW-574576		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
medium severity Buffer Overflow
SNYK-PYTHON-PILLOW-574577		 pillow:
6.2.2 -> 8.3.2
No No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-PYGMENTS-1086606		 pygments:
2.5.2 -> 2.7.4
No Proof of Concept
high severity Denial of Service (DoS)
SNYK-PYTHON-PYGMENTS-1088505		 pygments:
2.5.2 -> 2.7.4
No No Known Exploit
critical severity Arbitrary Code Execution
SNYK-PYTHON-PYYAML-590151		 pyyaml:
5.3.1 -> 5.4
No Mature
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-URLLIB3-1533435		 urllib3:
1.25.10 -> 1.26.5
No No Known Exploit

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the effected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

This change is Reviewable