search

netskopeoss / AWS-NPA-Publisher-AutoScaling

Apache License 2.0
2 stars 3 forks source link

Python libraries require updating #2

Open nwhobart opened 1 month ago

nwhobart commented 1 month ago

The Python libraries packaged with this script are out of date and have CVEs that require attention.

certifi (2021.5.30): (CVE-2022-23491), which affects the validity of root certificates due to a vulnerability involving the TrustCor certificate. It is recommended to upgrade to version 2022.12.07 or higher to remove the affected certificates​. The latest version of certifi is 2024.8.30​

idna (3.2): The current version is affected by CVE-2024-3651. It is recommended to upgrade to version 3.7​

requests (2.26.0): A medium-severity vulnerability (CVE-2023-32681) impacts this version. It's advised to upgrade to requests 2.31.0 or higher​. The latest available version is 2.32.3​

urllib3 (1.26.6): This version is affected by CVE-2024-37891, with medium severity. The recommended upgrade is to 1.26.19 or higher​.

Note: Updating the requests library on its own should handle all of these outdated libraries

nwhobart commented 4 weeks ago

Here's an updated zip file that contains the updated libraries.

NPAPublisherAutoscaling.zip