Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security updates #54

Merged
merged 4 commits into from Jan 8, 2019
Merged

Security updates #54

merged 4 commits into from Jan 8, 2019

Conversation

alanjds
Copy link
Contributor

@alanjds alanjds commented Jan 8, 2019

Upgrade packages to fix security issues:

  • Arbitrary code execution possibilities on not sanitized YAML parsing.
  • HTTP request headers making easier to guess internal keys.

@alanjds
Test against Python 3.5, 3.6 and 3.7
040deba
@alanjds
Merge branch 'master' into security-updates
dd663e5
@alanjds
Update PyYAML to 4.2b1, fixing CVE-2017-18342
61f8327 
Vulnerable versions: < 4.2b1
Patched version: 4.2b1
In PyYAML before 4.1, the yaml.load() API could execute arbitrary code.
In other words, yaml.safe_load is not used.
@alanjds
Update requests to 2.21.0, fixing CVE-2018-18074
55585e9 
Vulnerable versions: <= 2.19.1
Patched version: 2.20.0
The Requests package through 2.19.1 before 2018-09-14 for Python sends
an HTTP Authorization header to an http URI upon receiving a
same-hostname https-to-http redirect, which makes it easier for remote
attackers to discover credentials by sniffing the network.
@alanjds alanjds added the bug label Jan 8, 2019
iondrimba
iondrimba approved these changes Jan 8, 2019
View reviewed changes
Copy link

@iondrimba iondrimba left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Boa! 🚀

@alanjds alanjds merged commit 56f5850 into master Jan 8, 2019
@alanjds alanjds deleted the security-updates branch January 8, 2019 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@iondrimba iondrimba iondrimba approved these changes

@dtamai dtamai dtamai approved these changes

@thaismonti1912 thaismonti1912 thaismonti1912 approved these changes

@OtavioHenrique OtavioHenrique OtavioHenrique approved these changes

@eduardojmatos eduardojmatos Awaiting requested review from eduardojmatos

@sbneto sbneto Awaiting requested review from sbneto

@adelsjnr adelsjnr Awaiting requested review from adelsjnr

Assignees
No one assigned
Labels
bug
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@alanjds @iondrimba @dtamai @thaismonti1912 @OtavioHenrique