softwarefactory-project-zuul[bot]
commented
10 months ago Build failed. More information on how to proceed and troubleshoot errors available at https://fedoraproject.org/wiki/Zuul-based-ci https://fedora.softwarefactory-project.io/zuul/buildset/8f8792b6bd7345e3aeb316e3f4dcb249
:heavy_check_mark: fi-tox-mypy SUCCESS in 8m 23s :heavy_check_mark: fi-tox-lint SUCCESS in 10m 39s :heavy_check_mark: fi-tox-format SUCCESS in 8m 07s :x: fi-tox-python38 FAILURE in 12m 45s :x: fi-tox-python39 FAILURE in 14m 25s :x: fi-tox-python310 FAILURE in 12m 07s :x: fi-tox-python311 FAILURE in 9m 11s :x: fi-tox-docs FAILURE in 15m 18s :heavy_check_mark: fi-tox-bandit SUCCESS in 10m 29s :x: fi-tox-diff-cover FAILURE in 11m 01s
Zlopez
This PR contains the following updates:
2.3.7->3.0.1GitHub Vulnerability Alerts
CVE-2023-46136
Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer.
This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.