Latest data: Wed Nov 15 08:04:30 UTC 2023

Homebrew · Nov 15, 2023 · 5334b6d · 5334b6d
1 parent 1c8a84d
commit 5334b6d
Show file tree

Hide file tree

Showing 58 changed files with 354 additions and 1,027 deletions.
diff --git a/audits/alot-requirements.audit.json b/audits/alot-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-03T21:48:20Z",
+        "modified": "2023-11-08T04:11:58Z",
         "published": "2023-04-03T06:30:19Z",
         "schema_version": "1.6.0",
         "id": "GHSA-c33w-24p9-8m24",
@@ -126,12 +126,13 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-03T16:01:50Z",
+        "modified": "2023-11-08T04:13:41Z",
         "published": "2023-10-25T21:15:13Z",
         "schema_version": "1.6.0",
         "id": "GHSA-xc8x-vp79-p3wm",
         "aliases": [
-          "CVE-2023-46137"
+          "CVE-2023-46137",
+          "PYSEC-2023-224"
         ],
         "summary": "twisted.web has disordered HTTP pipeline response",
         "details": "Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.\n\n### Details\nThere's an example faulty program:\n```python\nfrom twisted.internet import reactor, endpoints\nfrom twisted.web import server\nfrom twisted.web.proxy import ReverseProxyResource\nfrom twisted.web.resource import Resource\n\nclass Second(Resource):\n    isLeaf = True\n    def render_GET(self, request):\n        return b'SECOND\\n'\n\nclass First(Resource):\n    isLeaf = True\n    def render_GET(self, request):\n        def send_response():\n            request.write(b'FIRST DELAYED\\n')\n            request.finish()\n        reactor.callLater(0.5, send_response)\n        return server.NOT_DONE_YET\n\nroot = Resource()\n\nroot.putChild(b'second', Second())\nroot.putChild(b'first', First())\n\nendpoint = endpoints.TCP4ServerEndpoint(reactor, 8080)\nendpoint.listen(server.Site(root))\nreactor.run()\n```\n\nWhen two requests for `/first` and `/second` are sent in the same order, the second request will be responded to first.\n```shell\necho -en \"GET /first HTTP/1.1\\r\\nHost: a\\r\\n\\r\\nGET /second HTTP/1.1\\r\\nHost: a\\r\\n\\r\\n\" | nc localhost 8080\n```",
@@ -292,7 +293,7 @@
         }
       },
       {
-        "modified": "2023-11-02T16:33:16Z",
+        "modified": "2023-11-08T04:13:41Z",
         "published": "2023-10-25T21:15:00Z",
         "schema_version": "1.6.0",
         "id": "PYSEC-2023-224",

diff --git a/audits/ansible-requirements.audit.json b/audits/ansible-requirements.audit.json
@@ -8,12 +8,13 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2021-07-25T23:34:38Z",
+        "modified": "2023-11-08T03:57:53Z",
         "published": "2017-08-25T18:29:00Z",
         "schema_version": "1.6.0",
         "id": "PYSEC-2017-49",
         "aliases": [
-          "CVE-2015-3206"
+          "CVE-2015-3206",
+          "PYSEC-2017-66"
         ],
         "details": "The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.",
         "affected": [

diff --git a/audits/athenacli-requirements.audit.json b/audits/athenacli-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-03T21:48:20Z",
+        "modified": "2023-11-08T04:11:58Z",
         "published": "2023-04-03T06:30:19Z",
         "schema_version": "1.6.0",
         "id": "GHSA-c33w-24p9-8m24",
@@ -126,12 +126,13 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-05T05:23:57Z",
+        "modified": "2023-11-08T04:10:25Z",
         "published": "2023-07-19T15:30:26Z",
         "schema_version": "1.6.0",
         "id": "GHSA-mrwq-x4v8-fh7p",
         "aliases": [
-          "CVE-2022-40896"
+          "CVE-2022-40896",
+          "PYSEC-2023-117"
         ],
         "summary": "Pygments vulnerable to ReDoS",
         "details": "A ReDoS issue was discovered in `pygments/lexers/smithy.py` in Pygments until 2.15.0 via SmithyLexer.",
@@ -280,12 +281,13 @@
         }
       },
       {
-        "modified": "2023-07-19T17:26:16Z",
+        "modified": "2023-11-08T04:10:25Z",
         "published": "2023-07-19T15:15:00Z",
         "schema_version": "1.6.0",
         "id": "PYSEC-2023-117",
         "aliases": [
-          "CVE-2022-40896"
+          "CVE-2022-40896",
+          "GHSA-mrwq-x4v8-fh7p"
         ],
         "details": "A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.",
         "affected": [

diff --git a/audits/aws-shell-requirements.audit.json b/audits/aws-shell-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-03T21:48:20Z",
+        "modified": "2023-11-08T04:11:58Z",
         "published": "2023-04-03T06:30:19Z",
         "schema_version": "1.6.0",
         "id": "GHSA-c33w-24p9-8m24",

diff --git a/audits/awscli-requirements.audit.json b/audits/awscli-requirements.audit.json
@@ -13,7 +13,8 @@
         "schema_version": "1.6.0",
         "id": "GHSA-cf7p-gm2m-833m",
         "aliases": [
-          "CVE-2023-38325"
+          "CVE-2023-38325",
+          "PYSEC-2023-112"
         ],
         "summary": "cryptography mishandles SSH certificates",
         "details": "The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.",
@@ -112,12 +113,13 @@
         }
       },
       {
-        "modified": "2023-08-21T15:28:13Z",
+        "modified": "2023-11-08T04:13:07Z",
         "published": "2023-07-14T20:15:00Z",
         "schema_version": "1.6.0",
         "id": "PYSEC-2023-112",
         "aliases": [
-          "CVE-2023-38325"
+          "CVE-2023-38325",
+          "GHSA-cf7p-gm2m-833m"
         ],
         "details": "The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.",
         "affected": [

diff --git a/audits/bbot-requirements.audit.json b/audits/bbot-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-05T05:19:34Z",
+        "modified": "2023-11-08T04:13:27Z",
         "published": "2023-10-04T15:30:35Z",
         "schema_version": "1.6.0",
         "id": "GHSA-ww3m-ffrm-qvqv",

diff --git a/audits/breezy-requirements.audit.json b/audits/breezy-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-03T21:48:20Z",
+        "modified": "2023-11-08T04:11:58Z",
         "published": "2023-04-03T06:30:19Z",
         "schema_version": "1.6.0",
         "id": "GHSA-c33w-24p9-8m24",

diff --git a/audits/buku-requirements.audit.json b/audits/buku-requirements.audit.json
@@ -8,12 +8,13 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-06T16:43:34Z",
+        "modified": "2023-11-08T04:13:39Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
         "aliases": [
-          "CVE-2023-45803"
+          "CVE-2023-45803",
+          "PYSEC-2023-212"
         ],
         "summary": "urllib3's request body not stripped after redirect from 303 status changes request method to GET",
         "details": "urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 303 \"See Other\" after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although the behavior of removing the request body is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers.\n\nFrom [RFC 9110 Section 9.3.1](https://www.rfc-editor.org/rfc/rfc9110.html#name-get):\n\n> A client SHOULD NOT generate content in a GET request unless it is made directly to an origin server that has previously indicated, in or out of band, that such a request has a purpose and will be adequately supported.\n\n## Affected usages\n\nBecause the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable.\n\nBoth of the following conditions must be true to be affected by this vulnerability:\n\n* If you're using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON)\n* The origin service is compromised and starts redirecting using 303 to a malicious peer or the redirected-to service becomes compromised.\n\n## Remediation\n\nYou can remediate this vulnerability with any of the following steps:\n\n* Upgrade to a patched version of urllib3 (v1.26.18 or v2.0.7)\n* Disable redirects for services that you aren't expecting to respond with redirects with `redirects=False`.\n* Disable automatic redirects with `redirects=False` and handle 303 redirects manually by stripping the HTTP request body.\n",
@@ -227,12 +228,13 @@
         }
       },
       {
-        "modified": "2023-11-04T00:48:52Z",
+        "modified": "2023-11-08T04:13:33Z",
         "published": "2023-10-02T23:27:05Z",
         "schema_version": "1.6.0",
         "id": "GHSA-v845-jxx5-vc9f",
         "aliases": [
-          "CVE-2023-43804"
+          "CVE-2023-43804",
+          "PYSEC-2023-192"
         ],
         "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects",
         "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.",
@@ -432,7 +434,7 @@
         }
       },
       {
-        "modified": "2023-10-10T14:28:19Z",
+        "modified": "2023-11-08T04:13:33Z",
         "published": "2023-10-04T17:15:00Z",
         "schema_version": "1.6.0",
         "id": "PYSEC-2023-192",
@@ -600,7 +602,7 @@
         ]
       },
       {
-        "modified": "2023-10-25T18:28:34Z",
+        "modified": "2023-11-08T04:13:39Z",
         "published": "2023-10-17T20:15:00Z",
         "schema_version": "1.6.0",
         "id": "PYSEC-2023-212",
@@ -796,7 +798,8 @@
         "schema_version": "1.6.0",
         "id": "GHSA-hrfv-mqp8-q5rw",
         "aliases": [
-          "CVE-2023-46136"
+          "CVE-2023-46136",
+          "PYSEC-2023-221"
         ],
         "summary": "Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning",
         "details": "Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer.\n\nThis allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.\n",

diff --git a/audits/bzt-requirements.audit.json b/audits/bzt-requirements.audit.json
@@ -8,12 +8,13 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-06T16:43:34Z",
+        "modified": "2023-11-08T04:13:39Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
         "aliases": [
-          "CVE-2023-45803"
+          "CVE-2023-45803",
+          "PYSEC-2023-212"
         ],
         "summary": "urllib3's request body not stripped after redirect from 303 status changes request method to GET",
         "details": "urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 303 \"See Other\" after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although the behavior of removing the request body is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers.\n\nFrom [RFC 9110 Section 9.3.1](https://www.rfc-editor.org/rfc/rfc9110.html#name-get):\n\n> A client SHOULD NOT generate content in a GET request unless it is made directly to an origin server that has previously indicated, in or out of band, that such a request has a purpose and will be adequately supported.\n\n## Affected usages\n\nBecause the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable.\n\nBoth of the following conditions must be true to be affected by this vulnerability:\n\n* If you're using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON)\n* The origin service is compromised and starts redirecting using 303 to a malicious peer or the redirected-to service becomes compromised.\n\n## Remediation\n\nYou can remediate this vulnerability with any of the following steps:\n\n* Upgrade to a patched version of urllib3 (v1.26.18 or v2.0.7)\n* Disable redirects for services that you aren't expecting to respond with redirects with `redirects=False`.\n* Disable automatic redirects with `redirects=False` and handle 303 redirects manually by stripping the HTTP request body.\n",
@@ -227,12 +228,13 @@
         }
       },
       {
-        "modified": "2023-11-04T00:48:52Z",
+        "modified": "2023-11-08T04:13:33Z",
         "published": "2023-10-02T23:27:05Z",
         "schema_version": "1.6.0",
         "id": "GHSA-v845-jxx5-vc9f",
         "aliases": [
-          "CVE-2023-43804"
+          "CVE-2023-43804",
+          "PYSEC-2023-192"
         ],
         "summary": "`Cookie` HTTP header isn't stripped on cross-origin redirects",
         "details": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.",
@@ -432,7 +434,7 @@
         }
       },
       {
-        "modified": "2023-10-10T14:28:19Z",
+        "modified": "2023-11-08T04:13:33Z",
         "published": "2023-10-04T17:15:00Z",
         "schema_version": "1.6.0",
         "id": "PYSEC-2023-192",
@@ -600,7 +602,7 @@
         ]
       },
       {
-        "modified": "2023-10-25T18:28:34Z",
+        "modified": "2023-11-08T04:13:39Z",
         "published": "2023-10-17T20:15:00Z",
         "schema_version": "1.6.0",
         "id": "PYSEC-2023-212",

diff --git a/audits/certbot-requirements.audit.json b/audits/certbot-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-11-03T21:48:20Z",
+        "modified": "2023-11-08T04:11:58Z",
         "published": "2023-04-03T06:30:19Z",
         "schema_version": "1.6.0",
         "id": "GHSA-c33w-24p9-8m24",