This project forked from shoprunner/collie
A library for preparing, training, and evaluating scalable deep learning hybrid recommender systems using PyTorch.
Home Page: https://collie.readthedocs.io/
License: BSD 3-Clause "New" or "Revised" License
![mend-for-github-com[bot] avatar](https://avatars.githubusercontent.com/in/30796?v=4 "mend-for-github-com[bot]")
Vulnerable Libraries - requests-2.27.0-py2.py3-none-any.whl, requests-2.26.0-py2.py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/47/01/f420e7add78110940639a958e5af0e3f8e07a8a8b62049bac55ee117aa91/requests-2.27.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/92/96/144f70b972a9c0eabbd4391ef93ccd49d0f2747f4f6a2a2738e99e5adc65/requests-2.26.0-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
Publish Date: 2024-05-20
URL: CVE-2024-35195
CVSS 3 Score Details (5.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-9wx4-h78v-vm56
Release Date: 2024-05-20
Fix Resolution: 2.32.0
Vulnerable Library - pytorch_lightning-1.5.7-py3-none-any.whlPyTorch Lightning is the lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.
Library home page: https://files.pythonhosted.org/packages/af/dd/a429f686df8d180235a00aad3cdb6e50c33bf41de307f1e45d3444398314/pytorch_lightning-1.5.7-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
pytorch-lightning is vulnerable to Deserialization of Untrusted Data
Publish Date: 2021-12-23
URL: CVE-2021-4118
CVSS 3 Score Details (7.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-4118
Release Date: 2021-12-23
Fix Resolution: 1.5.8
Vulnerable Library - aiohttp-3.8.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whlAsync http client/server framework (asyncio)
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
Publish Date: 2023-11-29
URL: CVE-2023-49082
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-qvrw-v9rv-5rjx
Release Date: 2023-11-29
Fix Resolution: aiohttp - 3.9.0
Vulnerable Library - Werkzeug-2.0.2-py3-none-any.whlThe comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/1e/73/51137805d1b8d97367a8a77cae4a792af14bb7ce58fbd071af294c740cf0/Werkzeug-2.0.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses request.data, request.form, request.files, or request.get_data(parse_form_data=False), it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.
Publish Date: 2023-02-14
URL: CVE-2023-25577
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-25577
Release Date: 2023-02-14
Fix Resolution: Werkzeug - 2.2.3
Vulnerable Libraries - tqdm-4.62.3-py2.py3-none-any.whl, tqdm-4.61.2-py2.py3-none-any.whl
Fast, Extensible Progress Meter
Library home page: https://files.pythonhosted.org/packages/63/f3/b7a1b8e40fd1bd049a34566eb353527bb9b8e9b98f8b6cf803bb64d8ce95/tqdm-4.62.3-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Fast, Extensible Progress Meter
Library home page: https://files.pythonhosted.org/packages/7a/ec/f8ff3ccfc4e59ce619a66a0bf29dc3b49c2e8c07de29d572e191c006eaa2/tqdm-4.61.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-05-03
URL: CVE-2024-34062
CVSS 3 Score Details (4.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-g7vv-2v7x-gj9p
Release Date: 2024-05-03
Fix Resolution: tqdm - 4.66.3
Vulnerable Library - aiohttp-3.8.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whlAsync http client/server framework (asyncio)
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
Publish Date: 2023-11-30
URL: CVE-2023-49081
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-q3qx-c6g2-7pw2
Release Date: 2023-11-30
Fix Resolution: aiohttp - 3.9.0
Vulnerable Libraries - urllib3-1.26.5-py2.py3-none-any.whl, urllib3-1.26.7-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/0c/cd/1e2ec680ec7b09846dc6e605f5a7709dfb9d7128e51a026e7154e18a234e/urllib3-1.26.5-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/af/f4/524415c0744552cce7d8bf3669af78e8a069514405ea4fcbd0cc44733744/urllib3-1.26.7-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Publish Date: 2023-10-04
URL: CVE-2023-43804
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-43804
Release Date: 2023-10-04
Fix Resolution: 1.26.17
Vulnerable Libraries - wheel-0.37.1-py2.py3-none-any.whl, wheel-0.36.2-py2.py3-none-any.whl
A built-package format for Python
Library home page: https://files.pythonhosted.org/packages/27/d6/003e593296a85fd6ed616ed962795b2f87709c3eee2bca4f6d0fe55c6d00/wheel-0.37.1-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
A built-package format for Python
Library home page: https://files.pythonhosted.org/packages/65/63/39d04c74222770ed1589c0eaba06c05891801219272420b40311cd60c880/wheel-0.36.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.
Publish Date: 2022-12-23
URL: CVE-2022-40898
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-12-23
Fix Resolution: 0.38.0
Vulnerable Library - numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whlNumPy is the fundamental package for array computing with Python.
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
** DISPUTED ** Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally).
WhiteSource Note: After conducting further research, WhiteSource has determined that numpy versions before 1.22.0 are vulnerable to CVE-2021-41496
Publish Date: 2021-12-17
URL: CVE-2021-41496
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41496
Release Date: 2021-12-17
Fix Resolution: numpy - 1.22.3
Vulnerable Library - aiohttp-3.8.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whlAsync http client/server framework (asyncio)
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie aiohttp.Application), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie aiohttp.ClientSession). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using AIOHTTP_NO_EXTENSIONS=1 as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable.
Publish Date: 2023-07-19
URL: CVE-2023-37276
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-45c4-8wx5-qw6w
Release Date: 2023-07-19
Fix Resolution: 3.8.5
Vulnerable Libraries - requests-2.27.0-py2.py3-none-any.whl, requests-2.26.0-py2.py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/47/01/f420e7add78110940639a958e5af0e3f8e07a8a8b62049bac55ee117aa91/requests-2.27.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/92/96/144f70b972a9c0eabbd4391ef93ccd49d0f2747f4f6a2a2738e99e5adc65/requests-2.26.0-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use rebuild_proxies to reattach the Proxy-Authorization header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the Proxy-Authorization header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
Publish Date: 2023-05-26
URL: CVE-2023-32681
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-j8r2-6x86-q33q
Release Date: 2023-05-26
Fix Resolution: 2.32.0
Vulnerable Library - numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whlFundamental package for array computing in Python
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Mend Note: After conducting further research, Mend has determined that versions 1.12.0 through 1.21.6 of numpy are vulnerable to CVE-2021-34141
Publish Date: 2021-12-17
URL: CVE-2021-34141
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34141
Release Date: 2021-12-17
Fix Resolution: 1.22.0
Vulnerable Library - joblib-1.1.0-py2.py3-none-any.whlLightweight pipelining with Python functions
Library home page: https://files.pythonhosted.org/packages/3e/d5/0163eb0cfa0b673aa4fe1cd3ea9d8a81ea0f32e50807b0c295871e4aab2e/joblib-1.1.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array().
Publish Date: 2024-05-19
URL: CVE-2024-34997
CVSS 3 Score Details (5.5)
Base Score Metrics:
Vulnerable Library - Werkzeug-2.0.2-py3-none-any.whlThe comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/1e/73/51137805d1b8d97367a8a77cae4a792af14bb7ce58fbd071af294c740cf0/Werkzeug-2.0.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =__Host-test=bad for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie =__Host-test=bad as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.
Publish Date: 2023-02-14
URL: CVE-2023-23934
CVSS 3 Score Details (3.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-23934
Release Date: 2023-02-14
Fix Resolution: Werkzeug - 2.2.3
Vulnerable Library - joblib-1.1.0-py2.py3-none-any.whlLightweight pipelining with Python functions
Library home page: https://files.pythonhosted.org/packages/3e/d5/0163eb0cfa0b673aa4fe1cd3ea9d8a81ea0f32e50807b0c295871e4aab2e/joblib-1.1.0-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Publish Date: 2022-09-26
URL: CVE-2022-21797
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-09-26
Fix Resolution: 1.2.0
Vulnerable Library - torch-1.10.1-cp37-cp37m-manylinux1_x86_64.whlTensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/20/8a/c1e970cf64a1fa105bc5064b353ecabe77974b69029a80d04580fee38d5f/torch-1.10.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.
Publish Date: 2022-11-26
URL: CVE-2022-45907
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-45907
Release Date: 2022-11-26
Fix Resolution: 1.13.1
Vulnerable Library - torch-1.10.1-cp37-cp37m-manylinux1_x86_64.whlTensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/20/8a/c1e970cf64a1fa105bc5064b353ecabe77974b69029a80d04580fee38d5f/torch-1.10.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Publish Date: 2024-04-17
URL: CVE-2024-31580
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-31580
Release Date: 2024-04-17
Fix Resolution: 2.2.0
Vulnerable Library - aiohttp-3.8.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whlAsync http client/server framework (asyncio)
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable show_index if unable to upgrade.
Publish Date: 2024-04-18
URL: CVE-2024-27306
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-7gpw-8wmc-pm8g
Release Date: 2024-04-18
Fix Resolution: 3.9.4
Vulnerable Library - oauthlib-3.1.1-py2.py3-none-any.whlA generic, spec-compliant, thorough implementation of the OAuth request-signing logic
Library home page: https://files.pythonhosted.org/packages/e8/5d/9dd1c29e5a786525f6342f6c1d812ed2e37edc653ad297048c1668988053/oauthlib-3.1.1-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of uri_validate functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly uri_validate are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.
Mend Note: After conducting further research, Mend has determined that versions 3.1.1 through 3.2.1 of oauthlib are vulnerable to CVE-2022-36087.
Publish Date: 2022-09-09
URL: CVE-2022-36087
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-3pgj-pg6c-r5p7
Release Date: 2022-09-09
Fix Resolution: oauthlib - 3.2.2
Vulnerable Library - setuptools-60.2.0-py3-none-any.whlEasily download, build, install, upgrade, and uninstall Python packages
Library home page: https://files.pythonhosted.org/packages/8e/16/8f64922c8d7cd7ec193b145c9b11ad281064ff8604452ba19a6d5bbd7ed9/setuptools-60.2.0-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
Publish Date: 2022-12-23
URL: CVE-2022-40897
CVSS 3 Score Details (5.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
Release Date: 2022-12-23
Fix Resolution: 65.5.1
Vulnerable Library - pytorch_lightning-1.5.7-py3-none-any.whlPyTorch Lightning is the lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.
Library home page: https://files.pythonhosted.org/packages/af/dd/a429f686df8d180235a00aad3cdb6e50c33bf41de307f1e45d3444398314/pytorch_lightning-1.5.7-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
Publish Date: 2022-03-05
URL: CVE-2022-0845
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-r5qj-cvf9-p85h
Release Date: 2022-03-05
Fix Resolution: 1.6.0
Vulnerable Library - torch-1.10.1-cp37-cp37m-manylinux1_x86_64.whlTensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/20/8a/c1e970cf64a1fa105bc5064b353ecabe77974b69029a80d04580fee38d5f/torch-1.10.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.
Publish Date: 2024-04-17
URL: CVE-2024-31583
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-31583
Release Date: 2024-04-17
Fix Resolution: 2.2.0
Vulnerable Library - aiohttp-3.8.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whlAsync http client/server framework (asyncio)
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Publish Date: 2024-01-29
URL: CVE-2024-23334
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-5h86-8mv2-jq9f
Release Date: 2024-01-29
Fix Resolution: 3.9.2
Vulnerable Libraries - protobuf-3.17.3-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.whl, protobuf-3.19.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
No project description provided
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
No project description provided
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
Publish Date: 2022-09-22
URL: CVE-2022-1941
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-8gq9-2x98-w8hf
Release Date: 2022-09-22
Fix Resolution: 3.18.3
Vulnerable Library - Werkzeug-2.0.2-py3-none-any.whlThe comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/1e/73/51137805d1b8d97367a8a77cae4a792af14bb7ce58fbd071af294c740cf0/Werkzeug-2.0.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.
Publish Date: 2022-05-25
URL: CVE-2022-29361
CVSS 3 Score Details (5.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29361
Release Date: 2022-05-25
Fix Resolution: Werkzeug - 2.1.1
Vulnerable Libraries - certifi-2021.10.8-py2.py3-none-any.whl, certifi-2021.5.30-py2.py3-none-any.whl
Python package for providing Mozilla's CA Bundle.
Library home page: https://files.pythonhosted.org/packages/37/45/946c02767aabb873146011e665728b680884cd8fe70dde973c640e45b775/certifi-2021.10.8-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Python package for providing Mozilla's CA Bundle.
Library home page: https://files.pythonhosted.org/packages/05/1b/0a0dece0e8aa492a6ec9e4ad2fe366b511558cdc73fd3abc82ba7348e875/certifi-2021.5.30-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
Publish Date: 2023-07-25
URL: CVE-2023-37920
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-xqr8-7jwr-rhp7
Release Date: 2023-07-25
Fix Resolution: 2023.7.22
Vulnerable Library - future-0.18.2.tar.gzClean single-source support for Python 3 and 2
Library home page: https://files.pythonhosted.org/packages/45/0b/38b06fd9b92dc2b68d58b75f900e97884c45bedd2ff83203d933cf5851c9/future-0.18.2.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
Publish Date: 2022-12-23
URL: CVE-2022-40899
CVSS 3 Score Details (7.5)
Base Score Metrics:
Vulnerable Library - aiohttp-3.8.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whlAsync http client/server framework (asyncio)
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
Mend Note: The vulnerability was fixed in version 3.9.4 (unaffected). A few minor follow-up patches were added in 3.9.5, as stated in GHSA-5m98-qgg9-wh84.
Publish Date: 2024-05-02
URL: CVE-2024-30251
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-5m98-qgg9-wh84
Release Date: 2024-05-02
Fix Resolution: 3.9.4
Vulnerable Library - aiohttp-3.8.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whlAsync http client/server framework (asyncio)
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.
Publish Date: 2024-01-29
URL: CVE-2024-23829
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-8qpw-xqxj-h4r2
Release Date: 2024-01-29
Fix Resolution: 3.9.2
Vulnerable Library - Werkzeug-2.0.2-py3-none-any.whlThe comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/1e/73/51137805d1b8d97367a8a77cae4a792af14bb7ce58fbd071af294c740cf0/Werkzeug-2.0.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in HEAD commit: e5eaed089d3cd53d48616effb42c3264df8f5779
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Publish Date: 2024-05-06
URL: CVE-2024-34069
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-2g68-c3qc-8985
Release Date: 2024-05-06
Fix Resolution: Werkzeug - 3.0.3
Vulnerable Library - Werkzeug-2.0.2-py3-none-any.whlThe comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/1e/73/51137805d1b8d97367a8a77cae4a792af14bb7ce58fbd071af294c740cf0/Werkzeug-2.0.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.
Publish Date: 2023-10-25
URL: CVE-2023-46136
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-hrfv-mqp8-q5rw
Release Date: 2023-10-25
Fix Resolution: 2.3.8
Vulnerable Library - torch-1.10.1-cp37-cp37m-manylinux1_x86_64.whlTensors and Dynamic neural networks in Python with strong GPU acceleration
Library home page: https://files.pythonhosted.org/packages/20/8a/c1e970cf64a1fa105bc5064b353ecabe77974b69029a80d04580fee38d5f/torch-1.10.1-cp37-cp37m-manylinux1_x86_64.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.
Publish Date: 2024-04-19
URL: CVE-2024-31584
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-31584
Release Date: 2024-04-19
Fix Resolution: 2.2.0
Vulnerable Libraries - certifi-2021.5.30-py2.py3-none-any.whl, certifi-2021.10.8-py2.py3-none-any.whl
Python package for providing Mozilla's CA Bundle.
Library home page: https://files.pythonhosted.org/packages/05/1b/0a0dece0e8aa492a6ec9e4ad2fe366b511558cdc73fd3abc82ba7348e875/certifi-2021.5.30-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
Python package for providing Mozilla's CA Bundle.
Library home page: https://files.pythonhosted.org/packages/37/45/946c02767aabb873146011e665728b680884cd8fe70dde973c640e45b775/certifi-2021.10.8-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.
Publish Date: 2022-12-07
URL: CVE-2022-23491
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-23491
Release Date: 2022-12-07
Fix Resolution: 2022.12.7
Vulnerable Libraries - urllib3-1.26.5-py2.py3-none-any.whl, urllib3-1.26.7-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/0c/cd/1e2ec680ec7b09846dc6e605f5a7709dfb9d7128e51a026e7154e18a234e/urllib3-1.26.5-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/af/f4/524415c0744552cce7d8bf3669af78e8a069514405ea4fcbd0cc44733744/urllib3-1.26.7-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like POST) to GET as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with redirects=False and disable automatic redirects with redirects=False and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.
Publish Date: 2023-10-17
URL: CVE-2023-45803
CVSS 3 Score Details (4.2)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-g4mx-q9vg-27p4
Release Date: 2023-10-17
Fix Resolution: 1.26.18
Vulnerable Library - aiohttp-3.8.1-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whlAsync http client/server framework (asyncio)
Path to dependency file: /tmp/ws-scm/collie
Path to vulnerable library: /tmp/ws-scm/collie
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit d5c12ba89 which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.
Publish Date: 2023-11-14
URL: CVE-2023-47627
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-gfw2-4jvh-wgfg
Release Date: 2023-11-14
Fix Resolution: 3.8.6
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.
