-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix vulnerabilities and refactor some parts #216
Comments
CI Build, job test-envs (CentOs7) reported
This required to update CentOs7/Dockerfile |
CentOs7 was removed from tested environments. |
Downloading a newer version of exasol_python_test_framework via pip install with requirements.txt seems to download multiple version of pyodbc. Some of them containing python code in their file setup.py that is no longer valid for Python10:
|
…217) * #216: Updated dependencies to fix vulnerabilities * Updated dependencies and URL for centos 7 docker image * Removed test for CentOs7 * Removed version spec for dependency requests in test/resources/test_container/full/build/deps/requirements.txt * Updated URLS to drivers JDBC and ODBC and ExaPlus from Exasol website * Updated file dependencies.md * Updated tar command for extracting downloaded drivers and exaplus * Updated path to ODBC driver * Updated version of github actions/checkout * Update documentation * refactored test_run_db_test_builtin_languages.py * Updated test-container OS to ubuntu:22.04 * Update pip in Docker TestContainer * Use latest version of exasol-python-test-framework from pypi * Added file error_code_config.yml * Removed file release_config.yml
FINGERPRINT=NoCertCheck
for Exasol DB ≥ version 8requests
in versions below2.32.0
caused by requestsSession
object not verifying requests after making first request withverify=False
boto3
tourllib3
in versions below2.2.2
caused by proxy-authorization request header not to be stripped during cross-origin redirects as no update of notebook-connector is available, yet.luigi
totornado
in versions below6.4.1
enabling CRLF injection inCurlAsyncHTTPClient
headers.luigi
totornado
in versions below6.4.1
due to inconsistent interpretation of HTTP Requests ('HTTP Request/Response Smuggling')configobj
in versions <=5.0.8
being ReDoS exploitable by developers using values in a server-side configuration file as SLCT is used only client side and pathed version are not available, yet.The text was updated successfully, but these errors were encountered: