Fix 6 vulnerable dependencies identified by Prisma Cloud #8
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![bridgecrew[bot]](https://avatars.githubusercontent.com/in/52968?s=60&v=4){kind=small}
| django==1.2 | ||
| flask==0.6 | ||
| requests==2.26.0 | ||
| django == 3.2.4 |
There was a problem hiding this comment.
django 3.2.4 / requirements.txt
Total vulnerabilities: 19
| Critical: 5 | High: 12 | Medium: 2 | Low: 0 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| CVE-2021-35042 |  CRITICAL |
9.8 | 3.2.5 |
Open |
| CVE-2022-28346 | CRITICAL |
9.8 | 3.2.13 |
Open |
| CVE-2022-28347 | CRITICAL |
9.8 | 3.2.13 |
Open |
| CVE-2022-34265 | CRITICAL |
9.8 | 3.2.14 |
Open |
| CVE-2023-31047 | CRITICAL |
9.8 | 3.2.19 |
Open |
| CVE-2023-43665 |  HIGH |
7.5 | 3.2.22 |
Open |
| CVE-2023-41164 | HIGH |
7.5 | 3.2.21 |
Open |
| CVE-2023-46695 | HIGH |
7.5 | 3.2.23 |
Open |
| CVE-2021-45116 | HIGH |
7.5 | 3.2.11 |
Open |
| CVE-2021-45115 | HIGH |
7.5 | 3.2.11 |
Open |
| CVE-2021-44420 | HIGH |
7.3 | 3.2.10 |
Open |
| CVE-2022-23833 | HIGH |
7.5 | 3.2.12 |
Open |
| CVE-2022-36359 | HIGH |
8.8 | 3.2.15 |
Open |
| CVE-2022-41323 | HIGH |
7.5 | 3.2.16 |
Open |
| CVE-2023-23969 | HIGH |
7.5 | 3.2.17 |
Open |
| CVE-2023-24580 | HIGH |
7.5 | 3.2.18 |
Open |
| CVE-2023-36053 | HIGH |
7.5 | 3.2.20 |
Open |
| CVE-2021-45452 |  MEDIUM |
5.3 | 3.2.11 |
Open |
| CVE-2022-22818 | MEDIUM |
6.1 | 3.2.12 |
Open |
ghouldaemon
force-pushed
the
pcc-vulnerability-fixes
branch
from
c9412b9
to
0daaf16
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Prisma Cloud has detected new vulnerabilities or dependencies in the scan performed on Fri, 05 Jan 2024 17:17:33 UTC
This PR includes the fixes for the vulnerabilities discovered below:
Set-Cookieheaders, it may send one client'ssessioncookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application setssession.permanent = True3. The application does not access or modify the session at any point during a request. 4.SESSION_REFRESH_EACH_REQUESTenabled (the default). 5. The application does not set aCache-Controlheader to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set theVary: Cookieheader when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.FileBackedOutputStreamin Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion ingo-gitclients. Applications using only the in-memory filesystem supported bygo-gitare not affected by this vulnerability. This is ago-gitimplementation issue and does not affect the upstreamgitcli. ### Patches Users running versions ofgo-gitfromv4and above are recommended to upgrade tov5.11in order to mitigate this vulnerability. ### Workarounds In cases where a bump to the latest version ofgo-gitis not possible, we recommend limiting its use to only trust-worthy Git servers. ## Credit Thanks to Ionut Lalu for responsibly disclosing this vulnerability to us. ### References - GHSA-mw99-9chc-xw7rgrpc.MaxConcurrentStreamsserver option to apply a limit to the server's resources used for any single connection. ### Workarounds None. ### References #6703promhttp.InstrumentHandler*middleware exceptRequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric withmethodlabel name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknownmethod. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing themethodlabel name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.rebuild_proxiesto reattach theProxy-Authorizationheader to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, theProxy-Authorizationheader must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.RandomAlphaNumeric(int)andCryptoRandomAlphaNumeric(int)are not as random as they should be. Small values ofintin the functions above will return a smaller subset of results than they should. For example,RandomAlphaNumeric(1)will always return a digit in the 0-9 range, whileRandomAlphaNumeric(4)will return around ~7 million of the ~13M possible permutations. This is considered a security release because programs that rely upon random generators for passwords are at an increased risk of brute force-style password guessing. There is also a higher probability of collision. The problem was the result of a mistaken regular expression that only accepted random strings if they contained a digit from[0-9]. That restriction has been removed. ### Patches This issue has been corrected in v1.1.1. ### Workarounds If you cannot upgrade to v1.1.1, you can work around the issue by callingRandomAlphaNumericCustom(N, true, true)