Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Fix for 86 vulnerabilities #275

Closed
wants to merge 1 commit into from

Conversation

MaKyOtOx
Copy link
Contributor

Snyk has created this PR to fix one or more vulnerable packages in the `pip` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • backend_app/requirements.macos.txt
⚠️ Warning
mongoengine 0.23.1 has requirement pymongo<4.0,>=3.4, but you have pymongo 4.6.3.
jinja2 3.1.4 has requirement MarkupSafe>=2.0, but you have MarkupSafe 1.1.1.
importlib-metadata 1.4.0 requires zipp, which is not installed.
django-auth-adfs 1.9.5 has requirement cryptography<39.0,>=1.7, but you have cryptography 43.0.1.

Vulnerabilities that will be fixed

By pinning:
Severity Issue Upgrade Breaking Change Exploit Maturity
medium severity HTTP Request Smuggling
SNYK-PYTHON-AIOHTTP-5798483
aiohttp:
3.8.1 -> 3.10.2
No Proof of Concept
medium severity HTTP Request Smuggling
SNYK-PYTHON-AIOHTTP-6057353
aiohttp:
3.8.1 -> 3.10.2
No Proof of Concept
medium severity Improper Input Validation
SNYK-PYTHON-AIOHTTP-6091621
aiohttp:
3.8.1 -> 3.10.2
No Proof of Concept
medium severity Improper Input Validation
SNYK-PYTHON-AIOHTTP-6091622
aiohttp:
3.8.1 -> 3.10.2
No Proof of Concept
medium severity HTTP Request Smuggling
SNYK-PYTHON-AIOHTTP-6091623
aiohttp:
3.8.1 -> 3.10.2
No No Known Exploit
medium severity Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
SNYK-PYTHON-AIOHTTP-6209406
aiohttp:
3.8.1 -> 3.10.2
No Proof of Concept
medium severity HTTP Request Smuggling
SNYK-PYTHON-AIOHTTP-6209407
aiohttp:
3.8.1 -> 3.10.2
No Proof of Concept
medium severity Cross-site Scripting (XSS)
SNYK-PYTHON-AIOHTTP-6645291
aiohttp:
3.8.1 -> 3.10.2
No No Known Exploit
high severity Infinite loop
SNYK-PYTHON-AIOHTTP-6808823
aiohttp:
3.8.1 -> 3.10.2
No No Known Exploit
medium severity UNIX Symbolic Link (Symlink) Following
SNYK-PYTHON-AIOHTTP-7675597
aiohttp:
3.8.1 -> 3.10.2
No No Known Exploit
medium severity Insufficient Verification of Data Authenticity
SNYK-PYTHON-CERTIFI-3164749
certifi:
2019.11.28 -> 2023.7.22
No No Known Exploit
critical severity Improper Following of a Certificate's Chain of Trust
SNYK-PYTHON-CERTIFI-5805047
certifi:
2019.11.28 -> 2023.7.22
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-3172287
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Expected Behavior Violation
SNYK-PYTHON-CRYPTOGRAPHY-3314966
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Use After Free
SNYK-PYTHON-CRYPTOGRAPHY-3315324
cryptography:
38.0.4 -> 43.0.1
No Proof of Concept
high severity Access of Resource Using Incompatible Type ('Type Confusion')
SNYK-PYTHON-CRYPTOGRAPHY-3315328
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Timing Attack
SNYK-PYTHON-CRYPTOGRAPHY-3315331
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-3315452
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-3315972
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-3315975
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-3316038
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-3316211
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-5663682
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
high severity Improper Certificate Validation
SNYK-PYTHON-CRYPTOGRAPHY-5777683
cryptography:
38.0.4 -> 43.0.1
No Proof of Concept
low severity Insufficient Verification of Data Authenticity
SNYK-PYTHON-CRYPTOGRAPHY-5813745
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-5813746
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
low severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-5813750
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-5914629
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Missing Cryptographic Step
SNYK-PYTHON-CRYPTOGRAPHY-6036192
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-CRYPTOGRAPHY-6050294
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity NULL Pointer Dereference
SNYK-PYTHON-CRYPTOGRAPHY-6092044
cryptography:
38.0.4 -> 43.0.1
No Proof of Concept
high severity Observable Timing Discrepancy
SNYK-PYTHON-CRYPTOGRAPHY-6126975
cryptography:
38.0.4 -> 43.0.1
No Proof of Concept
medium severity Use of a Broken or Risky Cryptographic Algorithm
SNYK-PYTHON-CRYPTOGRAPHY-6149518
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity Resource Exhaustion
SNYK-PYTHON-CRYPTOGRAPHY-6157248
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity NULL Pointer Dereference
SNYK-PYTHON-CRYPTOGRAPHY-6210214
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
medium severity NULL Pointer Dereference
SNYK-PYTHON-CRYPTOGRAPHY-6261585
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
low severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-PYTHON-CRYPTOGRAPHY-6592767
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
low severity Uncontrolled Resource Consumption
SNYK-PYTHON-CRYPTOGRAPHY-6913422
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
high severity Type Confusion
SNYK-PYTHON-CRYPTOGRAPHY-7886970
cryptography:
38.0.4 -> 43.0.1
No No Known Exploit
low severity Directory Traversal
SNYK-PYTHON-DJANGO-2329158
django:
3.1.14 -> 4.2.16
No No Known Exploit
low severity Information Exposure
SNYK-PYTHON-DJANGO-2329159
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-2329160
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-PYTHON-DJANGO-2389002
django:
3.1.14 -> 4.2.16
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-2389021
django:
3.1.14 -> 4.2.16
No No Known Exploit
critical severity SQL Injection
SNYK-PYTHON-DJANGO-2606966
django:
3.1.14 -> 4.2.16
No No Known Exploit
critical severity SQL Injection
SNYK-PYTHON-DJANGO-2606969
django:
3.1.14 -> 4.2.16
No Proof of Concept
critical severity SQL Injection
SNYK-PYTHON-DJANGO-2940618
django:
3.1.14 -> 4.2.16
No Proof of Concept
high severity Reflected File Download (RFD)
SNYK-PYTHON-DJANGO-2968205
django:
3.1.14 -> 4.2.16
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-3319450
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Arbitrary File Upload
SNYK-PYTHON-DJANGO-5496950
django:
3.1.14 -> 4.2.16
No No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-DJANGO-5750790
django:
3.1.14 -> 4.2.16
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-5880505
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-DJANGO-5932095
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-6041515
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-DJANGO-6370660
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-7435780
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Timing Attack
SNYK-PYTHON-DJANGO-7436273
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Directory Traversal
SNYK-PYTHON-DJANGO-7436514
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-7436646
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-7642790
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-7642791
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Uncontrolled Resource Consumption
SNYK-PYTHON-DJANGO-7642813
django:
3.1.14 -> 4.2.16
No No Known Exploit
critical severity SQL Injection
SNYK-PYTHON-DJANGO-7642814
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Improper Check for Unusual or Exceptional Conditions
SNYK-PYTHON-DJANGO-7886958
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Denial of Service (DoS)
SNYK-PYTHON-DJANGO-7886959
django:
3.1.14 -> 4.2.16
No No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-PYTHON-DJANGORESTFRAMEWORK-7252137
djangorestframework:
3.12.2 -> 3.15.2
No Proof of Concept
medium severity Insufficient Session Expiration
SNYK-PYTHON-DJANGORESTFRAMEWORKSIMPLEJWT-3104636
djangorestframework-simplejwt:
4.4.0 -> 5.2.2
No No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-FUTURE-3180414
future:
0.18.2 -> 0.18.3
No No Known Exploit
high severity HTTP Request Smuggling
SNYK-PYTHON-GUNICORN-6615672
gunicorn:
20.0.4 -> 22.0.0
No Proof of Concept
low severity Improper Check for Unusual or Exceptional Conditions
SNYK-PYTHON-GUNICORN-7856105
gunicorn:
20.0.4 -> 22.0.0
No No Known Exploit
medium severity Resource Exhaustion
SNYK-PYTHON-IDNA-6597975
idna:
2.8 -> 3.7
No No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-PYTHON-JINJA2-6150717
jinja2:
2.11.3 -> 3.1.4
No No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-PYTHON-JINJA2-6809379
jinja2:
2.11.3 -> 3.1.4
No No Known Exploit
high severity Use of a Broken or Risky Cryptographic Algorithm
SNYK-PYTHON-PYJWT-2840625
pyjwt:
1.7.1 -> 2.4.0
No Proof of Concept
medium severity Out-of-bounds Read
SNYK-PYTHON-PYMONGO-7172112
pymongo:
3.10.1 -> 4.6.3
No Proof of Concept
medium severity Information Exposure
SNYK-PYTHON-REQUESTS-5595532
requests:
2.25.1 -> 2.32.2
No No Known Exploit
medium severity Always-Incorrect Control Flow Implementation
SNYK-PYTHON-REQUESTS-6928867
requests:
2.25.1 -> 2.32.2
No No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-SETUPTOOLS-3180412
setuptools:
40.5.0 -> 70.0.0
No No Known Exploit
high severity Improper Control of Generation of Code ('Code Injection')
SNYK-PYTHON-SETUPTOOLS-7448482
setuptools:
40.5.0 -> 70.0.0
No Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-PYTHON-SQLPARSE-5426157
sqlparse:
0.4.2 -> 0.5.0
No No Known Exploit
high severity Uncontrolled Recursion
SNYK-PYTHON-SQLPARSE-6615674
sqlparse:
0.4.2 -> 0.5.0
No Proof of Concept
medium severity Injection
SNYK-PYTHON-TQDM-6807582
tqdm:
4.56.0 -> 4.66.3
No Proof of Concept
medium severity Information Exposure Through Sent Data
SNYK-PYTHON-URLLIB3-5926907
urllib3:
1.26.5 -> 1.26.19
No No Known Exploit
medium severity Information Exposure Through Sent Data
SNYK-PYTHON-URLLIB3-6002459
urllib3:
1.26.5 -> 1.26.19
No No Known Exploit
medium severity Improper Removal of Sensitive Information Before Storage or Transfer
SNYK-PYTHON-URLLIB3-7267250
urllib3:
1.26.5 -> 1.26.19
No No Known Exploit
medium severity Infinite loop
SNYK-PYTHON-ZIPP-7430899
zipp:
0.6.0 -> 3.19.1
No Proof of Concept

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improper Input Validation
🦉 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
🦉 Cross-site Scripting (XSS)
🦉 More lessons are available in Snyk Learn

The following vulnerabilities are fixed by pinning transitive dependencies:
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-5798483
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6057353
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6091621
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6091622
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6091623
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6209406
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6209407
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6645291
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-6808823
- https://snyk.io/vuln/SNYK-PYTHON-AIOHTTP-7675597
- https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-3164749
- https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-5805047
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3172287
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3314966
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3315324
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3315328
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3315331
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3315452
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3315972
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3315975
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3316038
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3316211
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-5663682
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-5777683
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-5813745
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-5813746
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-5813750
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-5914629
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6036192
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6050294
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6092044
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6126975
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6149518
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6157248
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6210214
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6261585
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6592767
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6913422
- https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-7886970
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2329158
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2329159
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2329160
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2389002
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2389021
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2606966
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2606969
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2940618
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2968205
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-3319450
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-5496950
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-5750790
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-5880505
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-5932095
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-6041515
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-6370660
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7435780
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7436273
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7436514
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7436646
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7642790
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7642791
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7642813
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7642814
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7886958
- https://snyk.io/vuln/SNYK-PYTHON-DJANGO-7886959
- https://snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORK-7252137
- https://snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORKSIMPLEJWT-3104636
- https://snyk.io/vuln/SNYK-PYTHON-FUTURE-3180414
- https://snyk.io/vuln/SNYK-PYTHON-GUNICORN-6615672
- https://snyk.io/vuln/SNYK-PYTHON-GUNICORN-7856105
- https://snyk.io/vuln/SNYK-PYTHON-IDNA-6597975
- https://snyk.io/vuln/SNYK-PYTHON-JINJA2-6150717
- https://snyk.io/vuln/SNYK-PYTHON-JINJA2-6809379
- https://snyk.io/vuln/SNYK-PYTHON-PYJWT-2840625
- https://snyk.io/vuln/SNYK-PYTHON-PYMONGO-7172112
- https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-5595532
- https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-6928867
- https://snyk.io/vuln/SNYK-PYTHON-SETUPTOOLS-3180412
- https://snyk.io/vuln/SNYK-PYTHON-SETUPTOOLS-7448482
- https://snyk.io/vuln/SNYK-PYTHON-SQLPARSE-5426157
- https://snyk.io/vuln/SNYK-PYTHON-SQLPARSE-6615674
- https://snyk.io/vuln/SNYK-PYTHON-TQDM-6807582
- https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-5926907
- https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-6002459
- https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-7267250
- https://snyk.io/vuln/SNYK-PYTHON-ZIPP-7430899
Copy link

@MaKyOtOx MaKyOtOx closed this Dec 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants