Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 4 vulnerabilities #2

Open
wants to merge 10 commits into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 4 vulnerabilities #2

wants to merge 10 commits into from

Conversation

LLotme
Copy link
Owner

@LLotme LLotme commented Jun 6, 2024

This PR was automatically created by Snyk using the credentials of a real user.


![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)

Snyk has created this PR to fix 4 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

  • tools/requirements/requirements.gdbgui.txt
⚠️ Warning ``` gdbgui 0.15.2.0 has requirement dnspython==2.4.2, but you have dnspython 2.3.0. gdbgui 0.15.2.0 has requirement jinja2==3.1.2, but you have jinja2 3.1.4. 
</details>





---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - Max score is 1000. Note that the real score may have changed since the PR was raised.
> - This PR was automatically created by Snyk using the credentials of a real user.
> - Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._

For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiIxYTI3NTcwNi0wMTY0LTQ2ZDEtOGRlMC1iYTdmYmFkODNhOTkiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjFhMjc1NzA2LTAxNjQtNDZkMS04ZGUwLWJhN2ZiYWQ4M2E5OSJ9fQ==" width="0" height="0"/>
🧐 [View latest project report](https://app.snyk.io/org/llotme/project/46d16902-7fbb-4094-bde6-78d5bc49a1e8?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr)
📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates)
🛠 [Adjust project settings](https://app.snyk.io/org/llotme/project/46d16902-7fbb-4094-bde6-78d5bc49a1e8?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings)
📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)

---

**Learn how to fix vulnerabilities with free interactive lessons:**

🦉 [Cross-site Scripting (XSS)](https://learn.snyk.io/lesson/xss/?loc&#x3D;fix-pr)
🦉 [Remote Code Execution (RCE)](https://learn.snyk.io/lesson/malicious-code-injection/?loc&#x3D;fix-pr)

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"jinja2","from":"3.1.2","to":"3.1.4"},{"name":"werkzeug","from":"2.2.3","to":"3.0.3"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-JINJA2-6150717","priority_score":484,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.4","score":270},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-JINJA2-6809379","priority_score":484,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.4","score":270},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-JINJA2-6150717","priority_score":484,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.4","score":270},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-JINJA2-6809379","priority_score":484,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.4","score":270},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-JINJA2-6150717","priority_score":484,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.4","score":270},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-JINJA2-6809379","priority_score":484,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.4","score":270},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cross-site Scripting (XSS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-WERKZEUG-6035177","priority_score":539,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Inefficient Algorithmic Complexity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-WERKZEUG-6808933","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-WERKZEUG-6035177","priority_score":539,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Inefficient Algorithmic Complexity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-WERKZEUG-6808933","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-WERKZEUG-6035177","priority_score":539,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Inefficient Algorithmic Complexity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-WERKZEUG-6808933","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-WERKZEUG-6035177","priority_score":539,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Inefficient Algorithmic Complexity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-WERKZEUG-6808933","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Code Execution (RCE)"}],"prId":"1a275706-0164-46d1-8de0-ba7fbad83a99","prPublicId":"1a275706-0164-46d1-8de0-ba7fbad83a99","packageManager":"pip","priorityScoreList":[484,484,539,589],"projectPublicId":"46d16902-7fbb-4094-bde6-78d5bc49a1e8","projectUrl":"https://app.snyk.io/org/llotme/project/46d16902-7fbb-4094-bde6-78d5bc49a1e8?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["pr-warning-shown","priorityScore"],"type":"auto","upgrade":[],"vulns":["SNYK-PYTHON-JINJA2-6150717","SNYK-PYTHON-JINJA2-6809379","SNYK-PYTHON-WERKZEUG-6035177","SNYK-PYTHON-WERKZEUG-6808933"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

sourcery-ai[bot]
sourcery-ai bot reviewed Jun 6, 2024
View reviewed changes
Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have skipped reviewing this pull request. Here's why:

  • It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
  • We don't currently review documentation changes - Let us know if you'd like us to change this.

@github-actions GitHub Actions
Copy link

github-actions bot commented Jun 6, 2024 •
edited by LLotme
Loading

Warnings
⚠️

Some issues found for the commit messages in this PR:

  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "Update requirements.gdbgui.txt":
    • summary looks empty
    • type/action looks empty
  • the commit message "fix: tools/requirements/requirements.gdbgui.txt to reduce vulnerabilities":
    • probably contains Jira ticket reference (JINJA2-6150717, JINJA2-6809379, WERKZEUG-6035177, WERKZEUG-6808933). Please remove Jira tickets from commit messages.

Please fix these commit messages - here are some basic tips:

  • follow Conventional Commits style
  • correct format of commit message should be: <type/action>(<scope/component>): <summary>, for example fix(esp32): Fixed startup timeout issue
  • allowed types are: change,ci,docs,feat,fix,refactor,remove,revert,test
  • sufficiently descriptive message summary should be between 20 to 72 characters and start with upper case letter
  • avoid Jira references in commit messages (unavailable/irrelevant for our customers)

TIP: Install pre-commit hooks and run this check when committing (uses the Conventional Precommit Linter).
⚠️ Please consider squashing your 10 commits (simplifying branch history).

👋 Hello LLotme, we appreciate your contribution to this project!

📘 Please review the project's Contributions Guide for key guidelines on code, documentation, testing, and more.
🖊️ Please also make sure you have read and signed the Contributor License Agreement for this project.
Click to see more instructions ...


This automated output is generated by the PR linter DangerJS, which checks if your Pull Request meets the project's requirements and helps you fix potential issues.

DangerJS is triggered with each push event to a Pull Request and modify the contents of this comment.

Please consider the following:
- Danger mainly focuses on the PR structure and formatting and can't understand the meaning behind your code or changes.
- Danger is not a substitute for human code reviews; it's still important to request a code review from your colleagues.
- Resolve all warnings (⚠️ ) before requesting a review from human reviewers - they will appreciate it.
- To manually retry these Danger checks, please navigate to the Actions tab and re-run last Danger workflow.

Review and merge process you can expect ...


We do welcome contributions in the form of bug reports, feature requests and pull requests via this public GitHub repository.

This GitHub project is public mirror of our internal git repository

1. An internal issue has been created for the PR, we assign it to the relevant engineer.
2. They review the PR and either approve it or ask you for changes or clarifications.
3. Once the GitHub PR is approved, we synchronize it into our internal git repository.
4. In the internal git repository we do the final review, collect approvals from core owners and make sure all the automated tests are passing.
- At this point we may do some adjustments to the proposed change, or extend it by adding tests or documentation.
5. If the change is approved and passes the tests it is merged into the default branch.
5. On next sync from the internal git repository merged change will appear in this public GitHub repository.

Generated by 🚫 dangerJS against 0239835

@cr-gpt CR.GPT
Copy link

cr-gpt bot commented Aug 10, 2024

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

@cr-gpt CR.GPT
Copy link

cr-gpt bot commented Aug 10, 2024

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

@cr-gpt CR.GPT
Copy link

cr-gpt bot commented Aug 10, 2024

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

@cr-gpt CR.GPT
Copy link

cr-gpt bot commented Aug 10, 2024

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

@cr-gpt CR.GPT
Copy link

cr-gpt bot commented Aug 13, 2024

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

@cr-gpt CR.GPT
Copy link

cr-gpt bot commented Aug 19, 2024

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

Repository owner deleted a comment from cr-gpt bot Aug 19, 2024
Repository owner deleted a comment from cr-gpt bot Aug 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sourcery-ai Sourcery AI sourcery-ai left review comments

Assignees
No one assigned
Labels
cla:signed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@LLotme @snyk-bot