Closed renovate[bot] closed 3 months ago
This PR contains the following updates:
==4.66.1
==4.66.3
Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. Example:
--delim
--buf-size
--manpath
eval
python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""
https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in tqdm>=4.66.3
tqdm>=4.66.3
None
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.
This PR contains the following updates:
==4.66.1
->==4.66.3
GitHub Vulnerability Alerts
CVE-2024-34062
Impact
Any optional non-boolean CLI arguments (e.g.
--delim
,--buf-size
,--manpath
) are passed through python'seval
, allowing arbitrary code execution. Example:Patches
https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in
tqdm>=4.66.3
Workarounds
None
References
Release Notes
tqdm/tqdm (tqdm)
### [`v4.66.3`](https://togithub.com/tqdm/tqdm/releases/tag/v4.66.3): tqdm v4.66.3 stable [Compare Source](https://togithub.com/tqdm/tqdm/compare/v4.66.2...v4.66.3) - `cli`: `eval` safety (fixes CVE-2024-34062, GHSA-g7vv-2v7x-gj9p) ### [`v4.66.2`](https://togithub.com/tqdm/tqdm/releases/tag/v4.66.2): tqdm v4.66.2 stable [Compare Source](https://togithub.com/tqdm/tqdm/compare/v4.66.1...v4.66.2) - `pandas`: add `DataFrame.progress_map` ([#1549](https://togithub.com/tqdm/tqdm/issues/1549)) - `notebook`: fix HTML padding ([#1506](https://togithub.com/tqdm/tqdm/issues/1506)) - `keras`: fix resuming training when `verbose>=2` ([#1508](https://togithub.com/tqdm/tqdm/issues/1508)) - fix `format_num` negative fractions missing leading zero ([#1548](https://togithub.com/tqdm/tqdm/issues/1548)) - fix Python 3.12 `DeprecationWarning` on `import` ([#1519](https://togithub.com/tqdm/tqdm/issues/1519)) - linting: use f-strings ([#1549](https://togithub.com/tqdm/tqdm/issues/1549)) - update tests ([#1549](https://togithub.com/tqdm/tqdm/issues/1549)) - fix `pandas` warnings - fix `asv` ([https://github.com/airspeed-velocity/asv/issues/1323](https://togithub.com/airspeed-velocity/asv/issues/1323)) - fix macos `notebook` docstring indentation - CI: bump actions ([#1549](https://togithub.com/tqdm/tqdm/issues/1549))Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.