Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-6437The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a dPyPI · nova · fixed in 12.0.0a0
- CVE-2013-6396The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, whPyPI · python-swiftclient · fixed in 2.0
- CVE-2014-1948OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the SwifPyPI · glance · fixed in 11.0.0a0
- CVE-2013-2191python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a PyPI · python-bugzilla · fixed in 0.9.0
- CVE-2013-7130The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and IcPyPI · nova · fixed in 12.0.0a0
- CVE-2013-4463OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users toPyPI · nova · fixed in 12.0.0a0
- CVE-2014-1604The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-crPyPI · rply · fixed in 0.7.1
- CVE-2014-1624Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-cPyPI · pyxdg · fixed in 0.26
- CVE-2013-7048OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporaryPyPI · nova · fixed in 12.0.0a0
- CVE-2014-0006The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to PyPI · swift · fixed in 1.12.0
- CVE-2013-2104python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remoPyPI · python-keystoneclient · fixed in 0.2.4
- CVE-2013-4200The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats PyPI · plone · fixed in 4.1.1, 4.2.6, 4.3.2
- CVE-2013-2037httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in thePyPI · httplib2 · fixed in 0.9, 0.10.1
- CVE-2013-6419Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant makingPyPI · nova · fixed in 12.0.0a0
- CVE-2013-6480Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sePyPI · apache-libcloud · fixed in 0.13.3
- CVE-2013-2030keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing cerPyPI · python-keystoneclient · fixed in 0.2.4
- CVE-2013-4510Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write PyPI · tryton, trytond · fixed in 3.0.1
- CVE-2013-4497The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when rePyPI · nova · fixed in 12.0.0a0
- CVE-2013-4435Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute PyPI · salt · fixed in 0.17.1
- CVE-2013-4436The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote atPyPI · salt · fixed in 0.17.1
- CVE-2013-4437Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."PyPI · salt · fixed in 0.17.1
- CVE-2013-4438Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors.PyPI · salt · fixed in 0.17.1
- CVE-2013-4439Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion PyPI · salt · fixed in 0.17.1
- CVE-2013-6617The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attaPyPI · salt · fixed in 0.17.1
- CVE-2013-4477The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that rolPyPI · keystone · fixed in 8.0.0a0
- CVE-2013-4469OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 imagePyPI · nova · fixed in 12.0.0a0
- CVE-2013-4185Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle networkPyPI · nova · fixed in 12.0.0a0
- CVE-2013-1445The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowinPyPI · pycrypto · fixed in 2.6.1
- CVE-2013-4249Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.PyPI · django · fixed in 1.5.2
- CVE-2013-6044The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as sPyPI · django · fixed in 1.4.6, 1.5.2