Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tweak pywin32 vers #2955

Closed

Conversation

jmackay-godaddy
Copy link

The library pywin32 is being flagged by GitHub Dependabot with an integer overflow vulnerability which can be used by an attacker to crash the process in question. docker-py has a conditional dependency on the fixed version 227 of this library. This PR upgrades that to 228 for python2 users and upgrades to 301 (which fixes the security issue) for python3 users.

…, and use the 3.x version if appropriate

Signed-off-by: Jason Mackay <jmackay@godaddy.com>
Signed-off-by: Jason Mackay <jmackay@godaddy.com>
@Nicoretti
Copy link

Nicoretti commented Feb 24, 2022

@jmackay-godaddy I think this PR duplicates #2943 more or less

@jmackay-godaddy
Copy link
Author

@jmackay-godaddy I think this PR duplicates #2943 more or less

Sure if you dont care about python 2 support go ahead use the other PR. This version retains Python2 support.

@gitpushdashf
Copy link

As the author of #2943 I'm fine with this. Not generally in favor of keeping Python 2 around any longer, but this might make sense for most people.

@milas
Copy link
Contributor

milas commented Jul 26, 2022

Hi! Thanks so much for your PR and apologies for the delay in review. A fix for this has been merged and we're planning to issue a new release containing it soon. For context, changes similar to yours were done in #3004 to address some CI changes in the repo, which blocked merging of your PR as-is, and given the delay on this, we wanted to be respectful of our contributor's time and not require you to rebase + re-review.

@milas milas closed this Jul 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants