Giter VIP home page Giter VIP logo

flow's Introduction

Flow

A CLI tool for common Continuous Integration/Continuous Delivery Tasks

Build Status Coverage Status PyPI version

Current Integrations:

  • Source Control/Build Management

  • Code Analysis

    • Sonar
    • QualityHub
    • QualityHub2
    • Fortify
  • Agile Process Management

    • Pivotal Tracker
    • Snowfield
  • Deployment Management

    • Pivotal Cloud Foundry
    • Google AppEngine
    • Google Kuberentes Engine
  • Notification Mangaement

  • Metrics

    • Grafana

Join Us

Development

For instructions on contributing, please see CONTRIBUTING.md.

Install

python3 setup.py install
which flow

NOTE: The installation may require sudo based on user permissions.

Setup/Configuration

Please configure buildConfig.json.

Usage

Github

Generates version numbers (using semantic versioning), attaches release notes and retrieves the latest version number.

Actions:

version - create new version, tag repo with version number and append build notes getversion - returns the latest version number.

Usage: flow github [Flags] [Action] [Environment]

Flags:

-v VERSION, --version VERSION (optional) If manually versioning, this is passed in by the user. Note: versionStrategy in buildConfig should be set to "manual"

-o OUTPUT, --output OUTPUT (optional) Writes the version number to a file. Use only if you need to persist the version number in a file.

--no-publish (optional) Stops publish to GitHub releases

-rnop RELEASE_NOTES_OUTPUT_PATH, --release-notes-output-path RELEASE_NOTES_OUTPUT_PATH (optional) Writes the release notes to a file. Use only if you need to persist the release notes in a file.

Environment Variables:

Variable Name Reqiured/Optional Description
TRACKER_TOKEN Required to access Pivotal Tracker story information when building release notes
GITHUB_TOKEN Required for access to your project API NOTE: Requires repo access only.
SLACK_WEBHOOK_URL Optional for sending error messages from Flow to your slack channel

For the help documentation, please check flow github -h


Tracker

Label stories with the version number.

Actions:

label-release - lookup stories in commit history and tag each story with the current version number

Usage: flow tracker [Flags] [Action] [Environment]

Flags:

-v VERSION, --version VERSION (optional) If manually versioning, this is passed in by the user. Note: versionStrategy in buildConfig should be set to "manual"

Environment Variables:

Variable Name Reqiured/Optional Description
TRACKER_TOKEN Required for accessing story information and labeling stories
GITHUB_TOKEN Required for access to your project API NOTE: Requires repo access only.
SLACK_WEBHOOK_URL Optional for sending error messages from Flow to your slack channel

Settings.ini (Global Settings):

  • url (required) to the tracker server. Priority is given if a value in buildConfig.json is specified.

For the help documentation, please check flow tracker -h


Slack

Publishes release notes after a deployment.

Actions:

release - ship release notes to slack after a deployment has completed

message - Sends custom slack messages. One use case is for sending flow deprecation messages to teams during their deployment.

Notes: If no channel is defined in buildConfig.json, this will publish to the default channel for the webhook. It also provides links for manually publishing to other environments specified in the buildConfig.json.

Usage: flow slack [Flags] [Action] [Environment]

Flags:

-c CHANNEL, --channel CHANNEL Slack channel to post in.

-v VERSION, --version VERSION (optional) Defaults to latest version. If upload is for a previous version, pass in the version number here.

-m MESSAGE, --message MESSAGE For use with message action. Message to be published.

-s USER, --user USER (optional) For use with message action. User name for message.

-i ICON, --icon ICON (optional) For use with message action. Icon to be displayed in footer.

-e EMOJI, --emoji EMOJI (optional) For use with message action. Emoji for message.

-a ATTACHMENT_COLOR, --attachment-color ATTACHMENT_COLOR (optional) For use with message action. Color for attachment bar.

-u SLACK_URL, --slack_url SLACK_URL (optional) For use with message action. Slack webhook url.

Environment Variables:

Variable Name Reqiured/Optional Description
TRACKER_TOKEN Required for accessing story information and labeling stories
GITHUB_TOKEN Required for access to your project API NOTE: Requires repo access only.
SLACK_WEBHOOK_URL Required for sending release notes to slack

Settings.ini (Global Settings):

  • bot_name (required) default bot name. Can be overridden by users in their buildConfig.json.

  • emoji (required) default emoji. Can be overridden by users in their buildConfig.json.

  • release_note_attachment_color (required) default bar color for release notes. Can be overridden by users in their buildConfig.json.

  • error_attachment_color (required) default bar color for errors sent to slack. Can be overridden by users in their buildConfig.json.

  • generic_message_slack_url (optional) sets generic channel when using the custom message feature of slack

For the help documentation, please check flow slack -h


Sonar

Triggers a sonar scan of your project.

Notes: Project configuration should be defined in sonar-project.properties. For an example, see this.

The sonar task requires installation of sonar-runner. The name of the local sonar runner executable needs to be defined in settings.ini.

The sonar task requires an environment variable, called SONAR_HOME that points to your sonar runner directory.

Actions:

scan - submit code to sonar for code quality scan

Usage: flow sonar [Flags] [Action] [Environment]

Flags:

-v VERSION, --version VERSION (optional) If manually versioning, this is passed in by the user.

Environment Variables:

Variable Name Reqiured/Optional Description
SLACK_WEBHOOK_URL Required for sending error messages from Flow to your slack channel

Settings.ini (Global Settings):

  • sonar_runner (required) path to sonar runner executable

For the help documentation, please check flow sonar -h


Artifactory

Task used to upload/download artifacts to/from artifactory.

Actions:

upload - uploads artifact to artifactory. location is based on settings in buildConfig.json.

download - downloads artifact from artifactory. location is based on settings in buildConfig.json and optional version number passed in.

NOTE: To include a POM in the upload, set includePom in your buildConfig.json, artifact stanza.

Usage: flow artifactory [Flags] [Action] [Environment]

Flags:

-x EXTRACT, --extract EXTRACT (optional) Only used for download action. Specifies whether the downloaded artifact should be extracted (only applies to .tar .tar.gz .zip file formats). Default True.

-v VERSION, --version VERSION (optional) If manually versioning, this is passed in by the user. Note: versionStrategy in buildConfig should be set to "manual"

Environment Variables:

Variable Name Reqiured/Optional Description
SLACK_WEBHOOK_URL Optional for sending error messages from Flow to your slack channel
ARTIFACTORY_TOKEN Required api token to artifactory OR encrypted password for user if used in conjunction with ARTIFACTORY_USER
ARTIFACTORY_USER Optional user for uploading to artifactory
ARTIFACT_BUILD_DIRECTORY Required directory location where artifact is built

For the help documentation, please check flow artifactory -h


CF (Pivotal Cloud Foundry)

Performs a zero-downtime deployment to cloud foundry expecting a manifest named after your environment (e.g. development.manifest.yml). The version for the deployed application defaults to the latest release in GitHub but can be overwritten with the -v or --version flag. This currently (12-07-16) requires an artifact in artifactory to function.

Actions:

deploy - push application to Pivotal Cloud Foundry

Usage: flow cf [Flags] [Action] [Environment]

Flags:

-v VERSION, --version VERSION (optional) Defaults to latest version. If deployment is for a previous version, pass in the version number here.

-f FORCE, --force FORCE (optional) Force the deploy even if the same version number is already running. Note: Zero-downtime deployment will not occur if forcing a deploy on the same version number.

-s SCRIPT, --script SCRIPT (optional) If you choose to use a custom deploy script instead of the default zero-downtime, pass in the path to deploy script here.

-metrics MANIFEST, --manifest MANIFEST (optional) Custom manifest name if you choose not to follow standard pattern of{environment}.manifest.yml

--no-download (optional) Skips downloading and extraction of artifact. Useful if the artifact was downloaded and extracted previously. Environment Variables:

Variable Name Reqiured/Optional Description
SLACK_WEBHOOK_URL Required for sending error messages from Flow to your slack channel
GITHUB_TOKEN Required for access to your project API NOTE: Requires repo access only.
ARTIFACTORY_TOKEN Required api token to artifactory OR encrypted password for user if used in conjunction with ARTIFACTORY_USER (api token is preferred over password)
DEPLOYMENT_USER Required for logging into PCF
DEPLOYMENT_PWD Required for logging into PCF
ARTIFACTORY_USER Optional User for uploading to artifactory
CF_BUILDPACK Optional Custom build packs should typically be indicated in your manifest; however, sometimes URLs for build packs may contains sensitive information, such as a github oauth token. You can use this environment variable to avoid exposing this in your manifest.
CF_VARS Optional to specify a vars file or path to vars file to use as argument for --vars-file

CF_VARS (optional) to specify a vars file or path to vars file to use as argument for --vars-file

CF_VARS (optional) to specify a vars file or path to vars file to use as argument for --vars-file

CF_VARS (optional) to specify a vars file or path to vars file to use as argument for --vars-file

Settings.ini (Global Settings):

  • cli_download_path (required) path to download cf cli

For the help documentation, please check flow cf -h


Google Cloud App Engine

Performs a deployment to Google App Engine expecting an application yaml named after your environment (e.g. app-development.yaml/yml) or a custom app-yml name to be passed in. The version for the deployed application defaults to the latest release in GitHub but can be overwritten with the -v or --version flag. This currently (12-07-16) requires an artifact in artifactory to function.

Actions:

deploy - ship version of code to Google Cloud App Engine

Usage: flow gcappengine [Flags] [Action] [Environment]

Flags:

-v VERSION, --version VERSION (optional) Defaults to latest version. If deployment is for a previous version, pass in the version number here.

-d DEPLOY_DIRECTORY, --deploy-directory DEPLOY_DIRECTORY (optional) Directory to download artifact to. By default it's downloaded to a new directory called 'fordeployment'

-y APP_YAML, --app-yaml APP_YAML (optional) Custom app manifest. Default is app-{environment}.yaml

-p PROMOTE, --promote PROMOTE (optional) Automatically promote new version and stop routing traffic to the older version. Default is true.

Environment Variables:

Variable Name Reqiured/Optional Description
GCAPPENGINE_USER_JSON Required the contents of a service account json created from Google's Instructions here NOTE: this is json content, not a uri to a file.
CLOUDSDK_CORE_PROJECT Required project name as displayed in google cloud

Settings.ini (Global Settings):

  • cloud_sdk_path (required) path to download gcloud cli

For the help documentation, please check flow gcappengine -h


License

Licensed under the Apache License


Key Contributors

Andrew Turner @aturnerbulldawg

Cade Thacker

Jeff Billimek

Corbett Waddingham

Jimmy Joy

Jermaine Davis

Nick Bunn

Preston Turner

Chris Leatherwood

Notable Mentions: Jeff Anderson, Patrick Baggett, Micahel Celeste, Mark Dedula, Adam Edelman, Chris Gruel, Joey Guerra, Nolan Hedstrom, Muhammad Ikram, John Jimenez, Shane Keels, David Kowis, John Mckenna, Winston Milling, Dhakshna Munusamy, Sanjay Nair, Nikeshbhai Patel, Priyesh Patel, Cody Stamps, Ian Stansbury, Alvaro Ramirez-del Villar

flow's People

Contributors

aturnerbulldawg avatar billimek avatar crstamps2 avatar dwood12 avatar eldirinice avatar gavinfigueroa avatar giggi1226 avatar hd-lj avatar jajomi avatar mend-for-github-com[bot] avatar mkdillard avatar mvalle21 avatar nareshgnt avatar pturnerdepot avatar wrmilling avatar

flow's Issues

CVE-2019-9740 (Medium) detected in urllib3-1.24.2-py2.py3-none-any.whl

CVE-2019-9740 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.24.2-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow

Dependency Hierarchy:

  • urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c78c9db7aa4d1fdd1aea6ad4e15a777c07e72d4d

Found in base branch: master

Vulnerability Details

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Publish Date: 2019-03-13

URL: CVE-2019-9740

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740

Release Date: 2019-03-13

Fix Resolution: v2.7.17,v3.5.8,v3.6.9,3.7.4,3.7.5


⛑️ Automatic Remediation is available for this issue

CVE-2020-26137 (Medium) detected in urllib3-1.24.2-py2.py3-none-any.whl

CVE-2020-26137 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.24.2-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow

Dependency Hierarchy:

  • urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c78c9db7aa4d1fdd1aea6ad4e15a777c07e72d4d

Found in base branch: master

Vulnerability Details

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Publish Date: 2020-09-30

URL: CVE-2020-26137

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26137

Release Date: 2020-09-30

Fix Resolution: 1.25.9


⛑️ Automatic Remediation is available for this issue

CVE-2023-32681 (Medium) detected in requests-2.25.1-py2.py3-none-any.whl

CVE-2023-32681 - Medium Severity Vulnerability

Vulnerable Library - requests-2.25.1-py2.py3-none-any.whl

Python HTTP for Humans.

Library home page: https://files.pythonhosted.org/packages/29/c1/24814557f1d22c56d50280771a17307e6bf87b70727d975fd6b2ce6b014a/requests-2.25.1-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow,/requirements.txt

Dependency Hierarchy:

  • requests-2.25.1-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use rebuild_proxies to reattach the Proxy-Authorization header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the Proxy-Authorization header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.

Publish Date: 2023-05-26

URL: CVE-2023-32681

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j8r2-6x86-q33q

Release Date: 2023-05-26

Fix Resolution: 2.32.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-28363 (Medium) detected in urllib3-1.26.3-py2.py3-none-any.whl

CVE-2021-28363 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.26.3-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/23/fc/8a49991f7905261f9ca9df5aa9b58363c3c821ce3e7f671895442b7100f2/urllib3-1.26.3-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

  • responses-0.8.1-py2.py3-none-any.whl (Root Library)
    • requests-2.25.1-py2.py3-none-any.whl
      • urllib3-1.26.3-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c78c9db7aa4d1fdd1aea6ad4e15a777c07e72d4d

Found in base branch: master

Vulnerability Details

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

Publish Date: 2021-03-15

URL: CVE-2021-28363

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5phf-pp7p-vc2r

Release Date: 2021-03-15

Fix Resolution: 1.26.4

CVE-2020-29651 (High) detected in py-1.4.31-py2.py3-none-any.whl

CVE-2020-29651 - High Severity Vulnerability

Vulnerable Library - py-1.4.31-py2.py3-none-any.whl

library with cross-python path, ini-parsing, io, code, log facilities

Library home page: https://files.pythonhosted.org/packages/19/f2/4b71181a49a4673a12c8f5075b8744c5feb0ed9eba352dd22512d2c04d47/py-1.4.31-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /tmp/ws-scm/flow,/flow

Dependency Hierarchy:

  • py-1.4.31-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.

Publish Date: 2020-12-09

URL: CVE-2020-29651

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hj5v-574p-mj7c

Release Date: 2020-12-09

Fix Resolution: 1.11.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-28363 (Medium) detected in urllib3-1.26.3-py2.py3-none-any.whl

CVE-2021-28363 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.26.3-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/23/fc/8a49991f7905261f9ca9df5aa9b58363c3c821ce3e7f671895442b7100f2/urllib3-1.26.3-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

  • responses-0.8.1-py2.py3-none-any.whl (Root Library)
    • requests-2.25.1-py2.py3-none-any.whl
      • urllib3-1.26.3-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

Publish Date: 2021-03-15

URL: CVE-2021-28363

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5phf-pp7p-vc2r

Release Date: 2021-03-15

Fix Resolution (urllib3): 1.26.4

Direct dependency fix Resolution (responses): 0.9.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24439 (High) detected in GitPython-2.0.2-py2.py3-none-any.whl

CVE-2022-24439 - High Severity Vulnerability

Vulnerable Library - GitPython-2.0.2-py2.py3-none-any.whl

Python Git Library

Library home page: https://files.pythonhosted.org/packages/9f/4e/c27ecaa02b1c6b6064c8c949d9203714fa228d127faf1b8e21f4759a5e89/GitPython-2.0.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow

Dependency Hierarchy:

  • GitPython-2.0.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c78c9db7aa4d1fdd1aea6ad4e15a777c07e72d4d

Found in base branch: master

Vulnerability Details

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Publish Date: 2022-12-06

URL: CVE-2022-24439

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2019-11236 (Medium) detected in urllib3-1.24.2-py2.py3-none-any.whl

CVE-2019-11236 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.24.2-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow

Dependency Hierarchy:

  • urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c78c9db7aa4d1fdd1aea6ad4e15a777c07e72d4d

Found in base branch: master

Vulnerability Details

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Publish Date: 2019-04-15

URL: CVE-2019-11236

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r64q-w8jr-g9qp

Release Date: 2019-04-15

Fix Resolution: urllib3 - 1.24.3


⛑️ Automatic Remediation is available for this issue

CVE-2019-11236 (Medium) detected in urllib3-1.24.2-py2.py3-none-any.whl

CVE-2019-11236 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.24.2-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow

Dependency Hierarchy:

  • urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Publish Date: 2019-04-15

URL: CVE-2019-11236

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r64q-w8jr-g9qp

Release Date: 2019-04-15

Fix Resolution: 1.24.3


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-35195 (Medium) detected in requests-2.25.1-py2.py3-none-any.whl

CVE-2024-35195 - Medium Severity Vulnerability

Vulnerable Library - requests-2.25.1-py2.py3-none-any.whl

Python HTTP for Humans.

Library home page: https://files.pythonhosted.org/packages/29/c1/24814557f1d22c56d50280771a17307e6bf87b70727d975fd6b2ce6b014a/requests-2.25.1-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow,/requirements.txt

Dependency Hierarchy:

  • requests-2.25.1-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.

Publish Date: 2024-05-20

URL: CVE-2024-35195

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9wx4-h78v-vm56

Release Date: 2024-05-20

Fix Resolution: 2.32.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-37920 (Critical) detected in certifi-2020.12.5-py2.py3-none-any.whl

CVE-2023-37920 - Critical Severity Vulnerability

Vulnerable Library - certifi-2020.12.5-py2.py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/5e/a0/5f06e1e1d463903cf0c0eebeb751791119ed7a4b3737fdc9a77f1cdfb51f/certifi-2020.12.5-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/tmp/ws-scm/flow

Dependency Hierarchy:

  • responses-0.8.1-py2.py3-none-any.whl (Root Library)
    • requests-2.25.1-py2.py3-none-any.whl
      • certifi-2020.12.5-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

Publish Date: 2023-07-25

URL: CVE-2023-37920

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xqr8-7jwr-rhp7

Release Date: 2023-07-25

Fix Resolution (certifi): 2023.7.22

Direct dependency fix Resolution (responses): 0.9.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-26137 (Medium) detected in urllib3-1.24.2-py2.py3-none-any.whl

CVE-2020-26137 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.24.2-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow

Dependency Hierarchy:

  • urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Publish Date: 2020-09-30

URL: CVE-2020-26137

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26137

Release Date: 2020-09-30

Fix Resolution: 1.25.9


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-29651 (High) detected in py-1.4.31-py2.py3-none-any.whl

CVE-2020-29651 - High Severity Vulnerability

Vulnerable Library - py-1.4.31-py2.py3-none-any.whl

library with cross-python path, ini-parsing, io, code, log facilities

Library home page: https://files.pythonhosted.org/packages/19/f2/4b71181a49a4673a12c8f5075b8744c5feb0ed9eba352dd22512d2c04d47/py-1.4.31-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /tmp/ws-scm/flow,/flow

Dependency Hierarchy:

  • py-1.4.31-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.

Publish Date: 2020-12-09

URL: CVE-2020-29651

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hj5v-574p-mj7c

Release Date: 2020-12-09

Fix Resolution: py - 1.10.0


⛑️ Automatic Remediation is available for this issue

CVE-2022-42969 (High) detected in py-1.10.0-py2.py3-none-any.whl, py-1.4.31-py2.py3-none-any.whl

CVE-2022-42969 - High Severity Vulnerability

Vulnerable Libraries - py-1.10.0-py2.py3-none-any.whl, py-1.4.31-py2.py3-none-any.whl

py-1.10.0-py2.py3-none-any.whl

library with cross-python path, ini-parsing, io, code, log facilities

Library home page: https://files.pythonhosted.org/packages/67/32/6fe01cfc3d1a27c92fdbcdfc3f67856da8cbadf0dd9f2e18055202b2dc62/py-1.10.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

  • pytest_mock-1.2-py2.py3-none-any.whl (Root Library)
    • pytest-2.9.2-py2.py3-none-any.whl
      • py-1.10.0-py2.py3-none-any.whl (Vulnerable Library)
py-1.4.31-py2.py3-none-any.whl

library with cross-python path, ini-parsing, io, code, log facilities

Library home page: https://files.pythonhosted.org/packages/19/f2/4b71181a49a4673a12c8f5075b8744c5feb0ed9eba352dd22512d2c04d47/py-1.4.31-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /tmp/ws-scm/flow,/flow

Dependency Hierarchy:

  • py-1.4.31-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c78c9db7aa4d1fdd1aea6ad4e15a777c07e72d4d

Found in base branch: master

Vulnerability Details

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.

Publish Date: 2022-10-16

URL: CVE-2022-42969

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2022-42969 (High) detected in py-1.10.0-py2.py3-none-any.whl, py-1.4.31-py2.py3-none-any.whl

CVE-2022-42969 - High Severity Vulnerability

Vulnerable Libraries - py-1.10.0-py2.py3-none-any.whl, py-1.4.31-py2.py3-none-any.whl

py-1.10.0-py2.py3-none-any.whl

library with cross-python path, ini-parsing, io, code, log facilities

Library home page: https://files.pythonhosted.org/packages/67/32/6fe01cfc3d1a27c92fdbcdfc3f67856da8cbadf0dd9f2e18055202b2dc62/py-1.10.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

  • pytest_mock-1.2-py2.py3-none-any.whl (Root Library)
    • pytest-2.9.2-py2.py3-none-any.whl
      • py-1.10.0-py2.py3-none-any.whl (Vulnerable Library)
py-1.4.31-py2.py3-none-any.whl

library with cross-python path, ini-parsing, io, code, log facilities

Library home page: https://files.pythonhosted.org/packages/19/f2/4b71181a49a4673a12c8f5075b8744c5feb0ed9eba352dd22512d2c04d47/py-1.4.31-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /tmp/ws-scm/flow,/flow

Dependency Hierarchy:

  • py-1.4.31-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.

Publish Date: 2022-10-16

URL: CVE-2022-42969

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2022-23491 (High) detected in certifi-2020.12.5-py2.py3-none-any.whl

CVE-2022-23491 - High Severity Vulnerability

Vulnerable Library - certifi-2020.12.5-py2.py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/5e/a0/5f06e1e1d463903cf0c0eebeb751791119ed7a4b3737fdc9a77f1cdfb51f/certifi-2020.12.5-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/tmp/ws-scm/flow

Dependency Hierarchy:

  • responses-0.8.1-py2.py3-none-any.whl (Root Library)
    • requests-2.25.1-py2.py3-none-any.whl
      • certifi-2020.12.5-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Publish Date: 2022-12-07

URL: CVE-2022-23491

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23491

Release Date: 2022-12-07

Fix Resolution (certifi): 2022.12.7

Direct dependency fix Resolution (responses): 0.9.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24439 (Critical) detected in GitPython-2.0.2-py2.py3-none-any.whl

CVE-2022-24439 - Critical Severity Vulnerability

Vulnerable Library - GitPython-2.0.2-py2.py3-none-any.whl

GitPython is a Python library used to interact with Git repositories

Library home page: https://files.pythonhosted.org/packages/9f/4e/c27ecaa02b1c6b6064c8c949d9203714fa228d127faf1b8e21f4759a5e89/GitPython-2.0.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow

Dependency Hierarchy:

  • GitPython-2.0.2-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Publish Date: 2022-12-06

URL: CVE-2022-24439

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2021-33503 (High) detected in urllib3-1.26.3-py2.py3-none-any.whl, urllib3-1.24.2-py2.py3-none-any.whl

CVE-2021-33503 - High Severity Vulnerability

Vulnerable Libraries - urllib3-1.26.3-py2.py3-none-any.whl, urllib3-1.24.2-py2.py3-none-any.whl

urllib3-1.26.3-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/23/fc/8a49991f7905261f9ca9df5aa9b58363c3c821ce3e7f671895442b7100f2/urllib3-1.26.3-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

  • responses-0.8.1-py2.py3-none-any.whl (Root Library)
    • requests-2.25.1-py2.py3-none-any.whl
      • urllib3-1.26.3-py2.py3-none-any.whl (Vulnerable Library)
urllib3-1.24.2-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow

Dependency Hierarchy:

  • urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Publish Date: 2021-06-29

URL: CVE-2021-33503

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q2q7-5pp4-w6pg

Release Date: 2021-06-29

Fix Resolution (urllib3): 1.26.5

Direct dependency fix Resolution (responses): 0.9.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-23491 (High) detected in certifi-2020.12.5-py2.py3-none-any.whl

CVE-2022-23491 - High Severity Vulnerability

Vulnerable Library - certifi-2020.12.5-py2.py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/5e/a0/5f06e1e1d463903cf0c0eebeb751791119ed7a4b3737fdc9a77f1cdfb51f/certifi-2020.12.5-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/tmp/ws-scm/flow

Dependency Hierarchy:

  • responses-0.8.1-py2.py3-none-any.whl (Root Library)
    • requests-2.25.1-py2.py3-none-any.whl
      • certifi-2020.12.5-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c78c9db7aa4d1fdd1aea6ad4e15a777c07e72d4d

Found in base branch: master

Vulnerability Details

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Publish Date: 2022-12-07

URL: CVE-2022-23491

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23491

Release Date: 2022-12-07

Fix Resolution: certifi - 2022.12.07

CVE-2019-9740 (Medium) detected in urllib3-1.24.2-py2.py3-none-any.whl

CVE-2019-9740 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.24.2-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow

Dependency Hierarchy:

  • urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Publish Date: 2019-03-13

URL: CVE-2019-9740

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740

Release Date: 2019-03-13

Fix Resolution: 1.24.3


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-33503 (High) detected in urllib3-1.26.3-py2.py3-none-any.whl, urllib3-1.24.2-py2.py3-none-any.whl

CVE-2021-33503 - High Severity Vulnerability

Vulnerable Libraries - urllib3-1.26.3-py2.py3-none-any.whl, urllib3-1.24.2-py2.py3-none-any.whl

urllib3-1.26.3-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/23/fc/8a49991f7905261f9ca9df5aa9b58363c3c821ce3e7f671895442b7100f2/urllib3-1.26.3-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

  • responses-0.8.1-py2.py3-none-any.whl (Root Library)
    • requests-2.25.1-py2.py3-none-any.whl
      • urllib3-1.26.3-py2.py3-none-any.whl (Vulnerable Library)
urllib3-1.24.2-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/df/1c/59cca3abf96f991f2ec3131a4ffe72ae3d9ea1f5894abe8a9c5e3c77cfee/urllib3-1.24.2-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/flow

Path to vulnerable library: /flow,/tmp/ws-scm/flow

Dependency Hierarchy:

  • urllib3-1.24.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: c78c9db7aa4d1fdd1aea6ad4e15a777c07e72d4d

Found in base branch: master

Vulnerability Details

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Publish Date: 2021-06-29

URL: CVE-2021-33503

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q2q7-5pp4-w6pg

Release Date: 2021-06-29

Fix Resolution: urllib3 - 1.26.5


⛑️ Automatic Remediation is available for this issue

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.