From 3a1005f1bd71a981dfc46e27b2b705e5f42b1333 Mon Sep 17 00:00:00 2001 From: "github.actions" Date: Sat, 7 Oct 2023 08:03:57 +0000 Subject: [PATCH] Latest data: Sat Oct 7 08:03:57 UTC 2023 --- audits/trafilatura-requirements.audit.json | 214 -------------------- audits/trailscraper-requirements.audit.json | 214 -------------------- audits/tvnamer-requirements.audit.json | 214 -------------------- audits/twarc-requirements.audit.json | 212 ------------------- audits/urlwatch-requirements.audit.json | 214 -------------------- audits/vdirsyncer-requirements.audit.json | 214 -------------------- audits/vunnel-requirements.audit.json | 214 -------------------- audits/watson-requirements.audit.json | 214 -------------------- audits/waybackpy-requirements.audit.json | 214 -------------------- audits/woob-requirements.audit.json | 214 -------------------- audits/wtfis-requirements.audit.json | 214 -------------------- audits/yle-dl-requirements.audit.json | 214 -------------------- audits/zabbix-cli-requirements.audit.json | 214 -------------------- requirements/all-repos-requirements.txt | 2 +- requirements/cfn-lint-requirements.txt | 14 +- requirements/csvkit-requirements.txt | 12 +- requirements/diffoscope-requirements.txt | 2 +- requirements/fprettify-requirements.txt | 1 + requirements/glances-requirements.txt | 2 +- requirements/pipx-requirements.txt | 6 +- requirements/trafilatura-requirements.txt | 8 +- requirements/trailscraper-requirements.txt | 12 +- requirements/tvnamer-requirements.txt | 4 +- requirements/twarc-requirements.txt | 10 +- requirements/urlwatch-requirements.txt | 4 +- requirements/vdirsyncer-requirements.txt | 8 +- requirements/vunnel-requirements.txt | 8 +- requirements/watson-requirements.txt | 9 +- requirements/waybackpy-requirements.txt | 6 +- requirements/west-requirements.txt | 4 +- requirements/woob-requirements.txt | 11 +- requirements/wtfis-requirements.txt | 8 +- requirements/yle-dl-requirements.txt | 4 +- requirements/zabbix-cli-requirements.txt | 4 +- 34 files changed, 70 insertions(+), 2849 deletions(-) delete mode 100644 audits/trafilatura-requirements.audit.json delete mode 100644 audits/trailscraper-requirements.audit.json delete mode 100644 audits/tvnamer-requirements.audit.json delete mode 100644 audits/urlwatch-requirements.audit.json delete mode 100644 audits/vdirsyncer-requirements.audit.json delete mode 100644 audits/vunnel-requirements.audit.json delete mode 100644 audits/watson-requirements.audit.json delete mode 100644 audits/waybackpy-requirements.audit.json delete mode 100644 audits/woob-requirements.audit.json delete mode 100644 audits/wtfis-requirements.audit.json delete mode 100644 audits/yle-dl-requirements.audit.json delete mode 100644 audits/zabbix-cli-requirements.audit.json create mode 100644 requirements/fprettify-requirements.txt diff --git a/audits/trafilatura-requirements.audit.json b/audits/trafilatura-requirements.audit.json deleted file mode 100644 index 98152386..00000000 --- a/audits/trafilatura-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.5", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/trailscraper-requirements.audit.json b/audits/trailscraper-requirements.audit.json deleted file mode 100644 index b9d43422..00000000 --- a/audits/trailscraper-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "1.26.14", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/tvnamer-requirements.audit.json b/audits/tvnamer-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/tvnamer-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/twarc-requirements.audit.json b/audits/twarc-requirements.audit.json index aa460a7c..053bb0a8 100644 --- a/audits/twarc-requirements.audit.json +++ b/audits/twarc-requirements.audit.json @@ -104,217 +104,5 @@ ] } ] - }, - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] } ] \ No newline at end of file diff --git a/audits/urlwatch-requirements.audit.json b/audits/urlwatch-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/urlwatch-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/vdirsyncer-requirements.audit.json b/audits/vdirsyncer-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/vdirsyncer-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/vunnel-requirements.audit.json b/audits/vunnel-requirements.audit.json deleted file mode 100644 index 98152386..00000000 --- a/audits/vunnel-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.5", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/watson-requirements.audit.json b/audits/watson-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/watson-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/waybackpy-requirements.audit.json b/audits/waybackpy-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/waybackpy-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/woob-requirements.audit.json b/audits/woob-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/woob-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/wtfis-requirements.audit.json b/audits/wtfis-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/wtfis-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/yle-dl-requirements.audit.json b/audits/yle-dl-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/yle-dl-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/audits/zabbix-cli-requirements.audit.json b/audits/zabbix-cli-requirements.audit.json deleted file mode 100644 index 90dcad3d..00000000 --- a/audits/zabbix-cli-requirements.audit.json +++ /dev/null @@ -1,214 +0,0 @@ -[ - { - "package": { - "name": "urllib3", - "version": "2.0.4", - "ecosystem": "PyPI", - "commit": "" - }, - "vulnerabilities": [ - { - "modified": "2023-10-04T19:48:40Z", - "published": "2023-10-02T23:27:05Z", - "schema_version": "1.6.0", - "id": "GHSA-v845-jxx5-vc9f", - "aliases": [ - "CVE-2023-43804" - ], - "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects", - "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.", - "affected": [ - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.0.0" - }, - { - "fixed": "2.0.6" - } - ] - } - ], - "versions": [ - "2.0.0", - "2.0.1", - "2.0.2", - "2.0.3", - "2.0.4", - "2.0.5" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - }, - { - "package": { - "ecosystem": "PyPI", - "name": "urllib3", - "purl": "pkg:pypi/urllib3" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "1.26.17" - } - ] - } - ], - "versions": [ - "0.2", - "0.3", - "0.3.1", - "0.4.0", - "0.4.1", - "1.0", - "1.0.1", - "1.0.2", - "1.1", - "1.10", - "1.10.1", - "1.10.2", - "1.10.3", - "1.10.4", - "1.11", - "1.12", - "1.13", - "1.13.1", - "1.14", - "1.15", - "1.15.1", - "1.16", - "1.17", - "1.18", - "1.18.1", - "1.19", - "1.19.1", - "1.2", - "1.2.1", - "1.2.2", - "1.20", - "1.21", - "1.21.1", - "1.22", - "1.23", - "1.24", - "1.24.1", - "1.24.2", - "1.24.3", - "1.25", - "1.25.1", - "1.25.10", - "1.25.11", - "1.25.2", - "1.25.3", - "1.25.4", - "1.25.5", - "1.25.6", - "1.25.7", - "1.25.8", - "1.25.9", - "1.26.0", - "1.26.1", - "1.26.10", - "1.26.11", - "1.26.12", - "1.26.13", - "1.26.14", - "1.26.15", - "1.26.16", - "1.26.2", - "1.26.3", - "1.26.4", - "1.26.5", - "1.26.6", - "1.26.7", - "1.26.8", - "1.26.9", - "1.3", - "1.4", - "1.5", - "1.6", - "1.7", - "1.7.1", - "1.8", - "1.8.2", - "1.8.3", - "1.9", - "1.9.1" - ], - "database_specific": { - "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-v845-jxx5-vc9f/GHSA-v845-jxx5-vc9f.json" - }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - } - } - ], - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb" - }, - { - "type": "WEB", - "url": "https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d" - }, - { - "type": "PACKAGE", - "url": "https://github.com/urllib3/urllib3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "github_reviewed": true, - "github_reviewed_at": "2023-10-02T23:27:05Z", - "nvd_published_at": null, - "severity": "MODERATE" - } - } - ], - "groups": [ - { - "ids": [ - "GHSA-v845-jxx5-vc9f" - ] - } - ] - } -] \ No newline at end of file diff --git a/requirements/all-repos-requirements.txt b/requirements/all-repos-requirements.txt index 6a3e3e0e..e10cfb58 100644 --- a/requirements/all-repos-requirements.txt +++ b/requirements/all-repos-requirements.txt @@ -1 +1 @@ -identify==2.5.24 +identify==2.5.30 diff --git a/requirements/cfn-lint-requirements.txt b/requirements/cfn-lint-requirements.txt index 7a8b3f81..ab1968b4 100644 --- a/requirements/cfn-lint-requirements.txt +++ b/requirements/cfn-lint-requirements.txt @@ -1,8 +1,8 @@ -annotated-types==0.5.0 +annotated-types==0.6.0 attrs==23.1.0 -aws-sam-translator==1.76.0 -boto3==1.28.58 -botocore==1.31.58 +aws-sam-translator==1.77.0 +boto3==1.28.62 +botocore==1.31.62 jmespath==1.0.1 jschema-to-python==1.2.3 jsonpatch==1.33 @@ -18,9 +18,9 @@ pydantic==2.4.2 pydantic-core==2.10.1 python-dateutil==2.8.2 referencing==0.30.2 -regex==2023.8.8 -rpds-py==0.10.3 +regex==2023.10.3 +rpds-py==0.10.4 s3transfer==0.7.0 sarif-om==1.0.4 sympy==1.12 -urllib3==1.26.17 +urllib3==2.0.6 diff --git a/requirements/csvkit-requirements.txt b/requirements/csvkit-requirements.txt index a3c13294..07b69b9a 100644 --- a/requirements/csvkit-requirements.txt +++ b/requirements/csvkit-requirements.txt @@ -1,18 +1,18 @@ agate==1.7.1 agate-dbf==0.2.2 agate-excel==0.2.5 -agate-sql==0.5.9 -Babel==2.11.0 +agate-sql==0.6.0 +babel==2.13.0 dbfread==2.0.7 et-xmlfile==1.1.0 -greenlet==2.0.2 isodate==0.6.1 leather==0.3.4 olefile==0.46 -openpyxl==3.1.1 +openpyxl==3.1.2 parsedatetime==2.6 -python-slugify==8.0.0 +python-slugify==8.0.1 pytimeparse==1.1.8 -SQLAlchemy==1.4.46 +sqlalchemy==2.0.21 text-unidecode==1.3 +typing-extensions==4.8.0 xlrd==2.0.1 diff --git a/requirements/diffoscope-requirements.txt b/requirements/diffoscope-requirements.txt index 46dec6be..062feed0 100644 --- a/requirements/diffoscope-requirements.txt +++ b/requirements/diffoscope-requirements.txt @@ -1,4 +1,4 @@ -argcomplete==3.1.1 +argcomplete==3.1.2 libarchive-c==5.0 progressbar==2.5 python-magic==0.4.27 diff --git a/requirements/fprettify-requirements.txt b/requirements/fprettify-requirements.txt new file mode 100644 index 00000000..faabc589 --- /dev/null +++ b/requirements/fprettify-requirements.txt @@ -0,0 +1 @@ +configargparse==1.7 diff --git a/requirements/glances-requirements.txt b/requirements/glances-requirements.txt index 04a6792c..b93c78fc 100644 --- a/requirements/glances-requirements.txt +++ b/requirements/glances-requirements.txt @@ -1,3 +1,3 @@ defusedxml==0.7.1 psutil==5.9.5 -ujson==5.7.0 +ujson==5.8.0 diff --git a/requirements/pipx-requirements.txt b/requirements/pipx-requirements.txt index 6a173044..42d55644 100644 --- a/requirements/pipx-requirements.txt +++ b/requirements/pipx-requirements.txt @@ -1,3 +1,3 @@ -argcomplete==2.1.1 -click==8.1.3 -userpath==1.8.0 +argcomplete==3.1.2 +click==8.1.7 +userpath==1.9.1 diff --git a/requirements/trafilatura-requirements.txt b/requirements/trafilatura-requirements.txt index e2dbb17c..edb41e94 100644 --- a/requirements/trafilatura-requirements.txt +++ b/requirements/trafilatura-requirements.txt @@ -1,4 +1,4 @@ -charset-normalizer==3.2.0 +charset-normalizer==3.3.0 courlan==0.9.4 dateparser==1.1.8 htmldate==1.5.1 @@ -6,7 +6,7 @@ justext==3.0.0 langcodes==3.3.0 python-dateutil==2.8.2 pytz==2023.3.post1 -regex==2023.8.8 +regex==2023.10.3 tld==0.13 -tzlocal==5.0.1 -urllib3==2.0.5 +tzlocal==5.1 +urllib3==2.0.6 diff --git a/requirements/trailscraper-requirements.txt b/requirements/trailscraper-requirements.txt index 1841421c..427d6304 100644 --- a/requirements/trailscraper-requirements.txt +++ b/requirements/trailscraper-requirements.txt @@ -1,14 +1,12 @@ boto3==1.26.54 -botocore==1.29.59 +botocore==1.29.165 click==8.1.3 dateparser==1.1.6 jmespath==1.0.1 python-dateutil==2.8.2 -pytz-deprecation-shim==0.1.0.post0 -regex==2022.10.31 +regex==2023.10.3 ruamel-yaml==0.17.21 -s3transfer==0.6.0 +s3transfer==0.6.2 toolz==0.12.0 -tzdata==2022.7 -tzlocal==4.2 -urllib3==1.26.14 +tzlocal==5.1 +urllib3==1.26.17 diff --git a/requirements/tvnamer-requirements.txt b/requirements/tvnamer-requirements.txt index 7844682e..f499344e 100644 --- a/requirements/tvnamer-requirements.txt +++ b/requirements/tvnamer-requirements.txt @@ -1,6 +1,6 @@ -charset-normalizer==3.2.0 +charset-normalizer==3.3.0 idna==3.4 requests==2.31.0 requests-cache==0.5.2 tvdb-api==3.1.0 -urllib3==2.0.4 +urllib3==2.0.6 diff --git a/requirements/twarc-requirements.txt b/requirements/twarc-requirements.txt index e65e132e..f1dfba17 100644 --- a/requirements/twarc-requirements.txt +++ b/requirements/twarc-requirements.txt @@ -1,13 +1,13 @@ -charset-normalizer==3.2.0 -click==8.1.6 +charset-normalizer==3.3.0 +click==8.1.7 click-config-file==0.6.0 click-plugins==1.1.1 configobj==5.0.8 -humanize==4.7.0 +humanize==4.8.0 idna==3.4 oauthlib==3.2.2 python-dateutil==2.8.2 requests==2.31.0 requests-oauthlib==1.3.1 -tqdm==4.65.0 -urllib3==2.0.4 +tqdm==4.66.1 +urllib3==2.0.6 diff --git a/requirements/urlwatch-requirements.txt b/requirements/urlwatch-requirements.txt index 96b8c1e5..eacf3efd 100644 --- a/requirements/urlwatch-requirements.txt +++ b/requirements/urlwatch-requirements.txt @@ -1,8 +1,8 @@ appdirs==1.4.4 -charset-normalizer==3.2.0 +charset-normalizer==3.3.0 cssselect==1.2.0 idna==3.4 lxml==4.9.3 minidb==2.0.7 requests==2.31.0 -urllib3==2.0.4 +urllib3==2.0.6 diff --git a/requirements/vdirsyncer-requirements.txt b/requirements/vdirsyncer-requirements.txt index 1b1fcdd3..7d13dea8 100644 --- a/requirements/vdirsyncer-requirements.txt +++ b/requirements/vdirsyncer-requirements.txt @@ -2,11 +2,11 @@ aiohttp==3.8.5 aiohttp-oauthlib==0.1.0 aiosignal==1.3.1 aiostream==0.4.5 -async-timeout==4.0.2 +async-timeout==4.0.3 atomicwrites==1.4.1 attrs==23.1.0 -charset-normalizer==3.2.0 -click==8.1.6 +charset-normalizer==3.3.0 +click==8.1.7 click-log==0.4.0 frozenlist==1.4.0 idna==3.4 @@ -14,5 +14,5 @@ multidict==6.0.4 oauthlib==3.2.2 requests==2.31.0 requests-toolbelt==1.0.0 -urllib3==2.0.4 +urllib3==2.0.6 yarl==1.9.2 diff --git a/requirements/vunnel-requirements.txt b/requirements/vunnel-requirements.txt index e23b6ce8..9e505420 100644 --- a/requirements/vunnel-requirements.txt +++ b/requirements/vunnel-requirements.txt @@ -1,4 +1,4 @@ -charset-normalizer==3.2.0 +charset-normalizer==3.3.0 click==8.1.7 click-default-group==1.2.4 colorlog==6.7.0 @@ -7,7 +7,7 @@ dataclass-wizard==0.22.2 defusedxml==0.7.1 docformatter==1.7.5 future==0.18.3 -greenlet==2.0.2 +greenlet==3.0.0 idna==3.4 ijson==2.6.1 importlib-metadata==6.8.0 @@ -22,7 +22,7 @@ rfc3339==6.2 sqlalchemy==1.4.49 toposort==1.10 untokenize==0.1.1 -urllib3==2.0.5 +urllib3==2.0.6 xsdata==23.8 -xxhash==3.3.0 +xxhash==3.4.1 zipp==3.17.0 diff --git a/requirements/watson-requirements.txt b/requirements/watson-requirements.txt index bb8627a6..59911c3c 100644 --- a/requirements/watson-requirements.txt +++ b/requirements/watson-requirements.txt @@ -1,8 +1,9 @@ -arrow==1.2.3 -charset-normalizer==3.2.0 -click==8.1.6 +arrow==1.3.0 +charset-normalizer==3.3.0 +click==8.1.7 click-didyoumean==0.3.0 idna==3.4 python-dateutil==2.8.2 requests==2.31.0 -urllib3==2.0.4 +types-python-dateutil==2.8.19.14 +urllib3==2.0.6 diff --git a/requirements/waybackpy-requirements.txt b/requirements/waybackpy-requirements.txt index 3e6714cc..7d8757e6 100644 --- a/requirements/waybackpy-requirements.txt +++ b/requirements/waybackpy-requirements.txt @@ -1,5 +1,5 @@ -charset-normalizer==3.2.0 -click==8.1.6 +charset-normalizer==3.3.0 +click==8.1.7 idna==3.4 requests==2.31.0 -urllib3==2.0.4 +urllib3==2.0.6 diff --git a/requirements/west-requirements.txt b/requirements/west-requirements.txt index b8e883e4..6d42758f 100644 --- a/requirements/west-requirements.txt +++ b/requirements/west-requirements.txt @@ -2,5 +2,5 @@ colorama==0.4.6 docopt==0.6.2 pykwalify==1.8.0 python-dateutil==2.8.2 -ruamel-yaml==0.17.31 -ruamel-yaml-clib==0.2.7 +ruamel-yaml==0.17.35 +ruamel-yaml-clib==0.2.8 diff --git a/requirements/woob-requirements.txt b/requirements/woob-requirements.txt index b97a5f3c..a20f12c6 100644 --- a/requirements/woob-requirements.txt +++ b/requirements/woob-requirements.txt @@ -1,5 +1,6 @@ -babel==2.12.1 -charset-normalizer==3.2.0 +babel==2.13.0 +certifi==2023.7.22 +charset-normalizer==3.3.0 colorama==0.4.6 html2text==2020.1.16 idna==3.4 @@ -9,6 +10,6 @@ mdurl==0.1.2 pycountry==22.3.5 python-dateutil==2.8.2 requests==2.31.0 -rich==13.4.2 -unidecode==1.3.6 -urllib3==2.0.4 +rich==13.6.0 +unidecode==1.3.7 +urllib3==2.0.6 diff --git a/requirements/wtfis-requirements.txt b/requirements/wtfis-requirements.txt index 401a3b40..392aeee3 100644 --- a/requirements/wtfis-requirements.txt +++ b/requirements/wtfis-requirements.txt @@ -1,5 +1,5 @@ -annotated-types==0.5.0 -charset-normalizer==3.2.0 +annotated-types==0.6.0 +charset-normalizer==3.3.0 click==8.1.7 click-plugins==1.1.1 colorama==0.4.6 @@ -12,5 +12,5 @@ python-dotenv==1.0.0 requests==2.31.0 rich==13.4.2 shodan==1.29.1 -urllib3==2.0.4 -xlsxwriter==3.1.2 +urllib3==2.0.6 +xlsxwriter==3.1.6 diff --git a/requirements/yle-dl-requirements.txt b/requirements/yle-dl-requirements.txt index 8d301ed3..630d67f8 100644 --- a/requirements/yle-dl-requirements.txt +++ b/requirements/yle-dl-requirements.txt @@ -1,8 +1,8 @@ attrs==23.1.0 -charset-normalizer==3.2.0 +charset-normalizer==3.3.0 configargparse==1.7 idna==3.4 lxml==4.9.3 requests==2.31.0 -urllib3==2.0.4 +urllib3==2.0.6 xattr==0.10.1 diff --git a/requirements/zabbix-cli-requirements.txt b/requirements/zabbix-cli-requirements.txt index 00b3afbb..68bf0810 100644 --- a/requirements/zabbix-cli-requirements.txt +++ b/requirements/zabbix-cli-requirements.txt @@ -1,4 +1,4 @@ -charset-normalizer==3.2.0 +charset-normalizer==3.3.0 idna==3.4 requests==2.31.0 -urllib3==2.0.4 +urllib3==2.0.6