Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-19687OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API.PyPI · keystone · fixed in 15.0.1, 16.0.1
- CVE-2019-19624An out-of-bounds read was discovered in OpenCV before 4.1.1.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2 · fixed in 4.1.0.25
- CVE-2019-19588The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain strinPyPI · validators · fixed in 0.12.6
- CVE-2013-2228SaltStack RSA Key Generation allows remote users to decrypt communicationsPyPI · salt · fixed in 0.15.1
- CVE-2019-19118Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing.PyPI · django · fixed in 2.1.15, 2.2.8
- CVE-2019-167662FA bypass in Wagtail through new device pathPyPI · wagtail-2fa · fixed in 1.3.0
- CVE-2019-14867A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thPyPI · freeipa, ipa · fixed in 4.6.7, 4.7.4, 4.8.3
- CVE-2019-10195A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thPyPI · freeipa, ipa · fixed in 4.6.7, 4.7.4, 4.8.3
- CVE-2019-19274typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read.PyPI · typed-ast · fixed in 1.3.2
- CVE-2019-19275typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read.PyPI · typed-ast · fixed in 1.3.2
- CVE-2019-14856ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a NonePyPI · ansible · fixed in 2.8.6, 2.7.14, 2.6.20
- CVE-2019-14853An error-handling flaw was found in python-ecdsa before version 0.13.3.PyPI · ecdsa · fixed in 0.13.3
- CVE-2011-4076OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivaPyPI · nova · fixed in 12.0.0a0
- CVE-2011-4924Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and PyPI · zope, zope2 · fixed in 3.7.3, 2.12.22, 2.13.12
- CVE-2019-10217A flaw was found in ansible 2.8.0 before 2.8.4.PyPI · ansible · fixed in 2.8.4
- CVE-2012-5578Python keyring has insecure permissions on new databases allowing world-readable files to be createdPyPI · keyring · fixed in 0.10.1, 0.10
- CVE-2015-5694Designate does not enforce the DNS protocol limit concerning record set sizesPyPI · designate
- CVE-2019-10206ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passPyPI · ansible · fixed in 2.6.19, 2.7.13, 2.8.4
- CVE-2014-1938python-rply before 0.7.4 insecurely creates temporary files.PyPI · rply · fixed in 0.7.4
- CVE-2012-2238trytond 2.4: ModelView.button fails to validate authorizationPyPI · trytond · fixed in 2.4.2
- CVE-2011-4952cobbler: Web interface lacks CSRF protection when using Django frameworkPyPI · cobbler · fixed in 2.6.0
- CVE-2019-19010Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to dPyPI · limnoria · fixed in 2019.11.09
- CVE-2014-7143Python Twisted 14.0 trustRoot is not respected in HTTP clientPyPI · twisted · fixed in 14.0.1
- CVE-2019-18874psutil (aka python-psutil) through 5.6.5 can have a double free.PyPI · psutil · fixed in 5.6.6
- CVE-2019-12408It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had PyPI · pyarrow · fixed in 0.15.1, 0.15.0
- CVE-2019-12410While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, leftPyPI · pyarrow · fixed in 0.15.0, 0.15.1
- CVE-2019-18835Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs.PyPI · matrix-synapse · fixed in 1.5.0
- CVE-2012-0051Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.PyPI · tahoe-lafs
- CVE-2013-5123The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackersPyPI · pip · fixed in 1.5
- CVE-2013-4409An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requestPyPI · djblets, reviewboard · fixed in 0.7.21, 0.6.30, 0.7.19 and more