Latest data: Fri Nov 3 08:04:34 UTC 2023

Homebrew · Nov 3, 2023 · f1b7a93 · f1b7a93
1 parent bfb9f88
commit f1b7a93
Show file tree

Hide file tree

Showing 36 changed files with 172 additions and 744 deletions.
diff --git a/audits/anime-downloader-requirements.audit.json b/audits/anime-downloader-requirements.audit.json
@@ -326,7 +326,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -517,6 +517,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/azure-cli-requirements.audit.json b/audits/azure-cli-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/bbot-requirements.audit.json b/audits/bbot-requirements.audit.json
@@ -220,7 +220,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -411,6 +411,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/buku-requirements.audit.json b/audits/buku-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"
@@ -779,7 +783,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-31T21:31:25Z",
+        "modified": "2023-11-02T17:16:00Z",
         "published": "2023-10-25T14:22:59Z",
         "schema_version": "1.6.0",
         "id": "GHSA-hrfv-mqp8-q5rw",
@@ -937,11 +941,16 @@
           {
             "type": "PACKAGE",
             "url": "https://github.com/pallets/werkzeug"
+          },
+          {
+            "type": "WEB",
+            "url": "https://github.com/pypa/advisory-database/tree/main/vulns/werkzeug/PYSEC-2023-221.yaml"
           }
         ],
         "database_specific": {
           "cwe_ids": [
-            "CWE-400"
+            "CWE-400",
+            "CWE-787"
           ],
           "github_reviewed": true,
           "github_reviewed_at": "2023-10-25T14:22:59Z",

diff --git a/audits/bzt-requirements.audit.json b/audits/bzt-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/charm-tools-requirements.audit.json b/audits/charm-tools-requirements.audit.json
@@ -8,15 +8,15 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-30T15:15:56Z",
+        "modified": "2023-11-02T21:26:55Z",
         "published": "2023-10-25T18:32:26Z",
         "schema_version": "1.6.0",
         "id": "GHSA-mq26-g339-26xf",
         "aliases": [
           "CVE-2023-5752"
         ],
         "summary": "Command Injection in pip when used with Mercurial",
-        "details": "When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.\n",
+        "details": "When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.",
         "affected": [
           {
             "package": {
@@ -234,7 +234,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -425,6 +425,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/cycode-requirements.audit.json b/audits/cycode-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/fdroidserver-requirements.audit.json b/audits/fdroidserver-requirements.audit.json
@@ -350,7 +350,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -541,6 +541,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/flintrock-requirements.audit.json b/audits/flintrock-requirements.audit.json
@@ -210,7 +210,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -401,6 +401,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/gyb-requirements.audit.json b/audits/gyb-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/jenkins-job-builder-requirements.audit.json b/audits/jenkins-job-builder-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/linode-cli-requirements.audit.json b/audits/linode-cli-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/mvt-requirements.audit.json b/audits/mvt-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/onlykey-agent-requirements.audit.json b/audits/onlykey-agent-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/openai-whisper-requirements.audit.json b/audits/openai-whisper-requirements.audit.json
@@ -8,7 +8,7 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-26T14:47:11Z",
+        "modified": "2023-11-03T03:46:08Z",
         "published": "2023-10-17T20:15:25Z",
         "schema_version": "1.6.0",
         "id": "GHSA-g4mx-q9vg-27p4",
@@ -199,6 +199,10 @@
             "type": "WEB",
             "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
           },
+          {
+            "type": "WEB",
+            "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
+          },
           {
             "type": "WEB",
             "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"

diff --git a/audits/pypy-requirements.audit.json b/audits/pypy-requirements.audit.json
@@ -201,15 +201,15 @@
         }
       },
       {
-        "modified": "2023-10-30T15:15:56Z",
+        "modified": "2023-11-02T21:26:55Z",
         "published": "2023-10-25T18:32:26Z",
         "schema_version": "1.6.0",
         "id": "GHSA-mq26-g339-26xf",
         "aliases": [
           "CVE-2023-5752"
         ],
         "summary": "Command Injection in pip when used with Mercurial",
-        "details": "When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.\n",
+        "details": "When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.",
         "affected": [
           {
             "package": {

diff --git a/audits/pypy3.10-requirements.audit.json b/audits/pypy3.10-requirements.audit.json
@@ -8,15 +8,15 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-30T15:15:56Z",
+        "modified": "2023-11-02T21:26:55Z",
         "published": "2023-10-25T18:32:26Z",
         "schema_version": "1.6.0",
         "id": "GHSA-mq26-g339-26xf",
         "aliases": [
           "CVE-2023-5752"
         ],
         "summary": "Command Injection in pip when used with Mercurial",
-        "details": "When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.\n",
+        "details": "When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.",
         "affected": [
           {
             "package": {

diff --git a/audits/pypy3.9-requirements.audit.json b/audits/pypy3.9-requirements.audit.json
@@ -8,15 +8,15 @@
     },
     "vulnerabilities": [
       {
-        "modified": "2023-10-30T15:15:56Z",
+        "modified": "2023-11-02T21:26:55Z",
         "published": "2023-10-25T18:32:26Z",
         "schema_version": "1.6.0",
         "id": "GHSA-mq26-g339-26xf",
         "aliases": [
           "CVE-2023-5752"
         ],
         "summary": "Command Injection in pip when used with Mercurial",
-        "details": "When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.\n",
+        "details": "When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.",
         "affected": [
           {
             "package": {