search

jetbridge / flask_cognito

Flask authentication with JWT against AWS Cognito
MIT License
94 stars 30 forks source link

Bump ecdsa from 0.13.2 to 0.13.3 #8

Closed dependabot[bot] closed 4 years ago

dependabot[bot] commented 4 years ago

Bumps ecdsa from 0.13.2 to 0.13.3.

Release notes *Sourced from [ecdsa's releases](https://github.com/warner/python-ecdsa/releases).* > ## ecdsa 0.13.3 > Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding > Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding > > Also harden key decoding from string and DER encodings.
Changelog *Sourced from [ecdsa's changelog](https://github.com/warner/python-ecdsa/blob/master/NEWS).* > * Release 0.13.3 (07 Oct 2019) > > Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding and > signature malleability. > > Also harden key decoding from string and DER encodings. > > * Release 0.13.2 (17 Apr 2019) > > Restore compatibility of setup.py with Python 2.6 and 2.7. > > * Release 0.13.1 (17 Apr 2019) > > Fix the PyPI wheel - the old version included .pyc files. > > * Release 0.13 (07 Feb 2015) > > Fix the argument order for Curve constructor (put openssl_name= at the end, > with a default value) to unbreak compatibility with external callers who used > the 0.11 convention. > > * Release 0.12 (06 Feb 2015) > > Switch to Versioneer for version-string management (fixing the broken > `ecdsa.__version__` attribute). Add Curve.openssl_name property. Mention > secp256k1 in README, test against OpenSSL. Produce "wheel" distributions. Add > py3.4 and pypy3 compatibility testing. Other minor fixes. > > * Release 0.11 (10 Mar 2014) > > Add signature-encoding functions "sigencode_{strings,string,der}_canonize" > which canonicalize the S value (using the smaller of the two possible > values). Add "validate_point=" argument to VerifyingKey.from_string() > constructor (defaults to True) which can be used to disable time-consuming > point validation when importing a pre-validated verifying key. Drop python2.5 > support (untested but not explicitly broken yet), update trove classifiers. > > * Release 0.10 (23 Oct 2013) > > Make the secp256k1 available in __init__.py too (thanks to Scott Bannert). > > * Release 0.9 (01 Oct 2013) > > Add secp256k1 curve (thanks to Benjamin Dauvergne). Add deterministic (no > entropy needed) signatures (thanks to slush). Added py3.2/py3.3 compatibility > (thanks to Elizabeth Myers). > > * Release 0.8 (04 Oct 2011) > > Small API addition: accept a hashfunc= argument in the constructors for > ... (truncated)
Commits - [`7add221`](https://github.com/warner/python-ecdsa/commit/7add2213c992f51267eed8288b560f3f4108a28d) update NEWS file for 0.13.3 - [`5c4c74a`](https://github.com/warner/python-ecdsa/commit/5c4c74a454c852727ac3c0207a4010486dde1866) Merge pull request [#124](https://github-redirect.dependabot.com/warner/python-ecdsa/issues/124) from tomato42/backport-sig-decode - [`1eb2c04`](https://github.com/warner/python-ecdsa/commit/1eb2c0410b97ac5101b5db20e2924d79db3e8ec5) update README with error handling of from_string() and from_der() - [`b95be03`](https://github.com/warner/python-ecdsa/commit/b95be03d8540b3a088263cbb3a0a376a8a0efbd0) execute also new tests in Travis - [`99c907d`](https://github.com/warner/python-ecdsa/commit/99c907d7acc94da6685470328174ea7299863dfd) harden also key decoding - [`3427fa2`](https://github.com/warner/python-ecdsa/commit/3427fa29f319b27898a28601955807abb44c0830) ensure that the encoding is actually the minimal one for length and integer - [`563d2ee`](https://github.com/warner/python-ecdsa/commit/563d2ee2c07e10ae4f77ccde4161d6a14c681b1b) make variable names in remove_integer more aproppriate - [`14abfe0`](https://github.com/warner/python-ecdsa/commit/14abfe020d4907fd9849f269b98f5f8f1060366b) explicitly specify the distro to get py26 and py33 - [`9080d1d`](https://github.com/warner/python-ecdsa/commit/9080d1d5ac533da0de00466aaffb49bee808bb4e) fix length decoding - [`897178c`](https://github.com/warner/python-ecdsa/commit/897178ca093282979ff19cc4035eadbc30ac0d23) give the same handling to string encoded signatures as to DER - Additional commits viewable in [compare view](https://github.com/warner/python-ecdsa/compare/python-ecdsa-0.13.2...python-ecdsa-0.13.3)


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/jetbridge/flask_cognito/network/alerts).