Skip to content

fix: requirements.txt to reduce vulnerabilities

945af7b
Select commit
Loading
Failed to load commit list.
Open

[Snyk] Security upgrade gunicorn from 20.0.4 to 21.2.0 #211

fix: requirements.txt to reduce vulnerabilities
945af7b
Select commit
Loading
Failed to load commit list.
Mend Bolt for GitHub / WhiteSource Security Check failed Sep 2, 2024 in 4m 49s

Security Report

You have successfully remediated 10 vulnerabilities, but introduced 25 new vulnerabilities in this branch.

❌ New vulnerabilities:

CVE Severity CVSS Score Vulnerable Library Suggested Fix Issue
CVE-2021-41945

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ httpx-0.16.1-py3-none-any.whl (Vulnerable Library)

Critical 9.1 httpx-0.16.1-py3-none-any.whl Upgrade to version: httpx - 0.23.0 None
CVE-2020-36242

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

Critical 9.1 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: cryptography - 3.3.2 None
CVE-2021-32677

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ fastapi-0.61.1-py3-none-any.whl (Vulnerable Library)

High 8.1 fastapi-0.61.1-py3-none-any.whl Upgrade to version: fastapi - 0.65.2 None
CVE-2023-4807

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

High 7.8 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: openssl-3.0.11,openssl-3.1.3,OpenSSL_1_1_1w, cryptography - 41.0.4 None
WS-2023-0037

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ starlette-0.13.6-py3-none-any.whl (Vulnerable Library)

High 7.5 starlette-0.13.6-py3-none-any.whl Upgrade to version: starlette - 0.25.0 None
CVE-2024-34069

Path to dependency file: /tmp/ws-scm/mergify-engine

Path to vulnerable library: /tmp/ws-scm/mergify-engine

Dependency Hierarchy:

-> ❌ Werkzeug-2.2.3-py3-none-any.whl (Vulnerable Library)

High 7.5 Werkzeug-2.2.3-py3-none-any.whl Upgrade to version: Werkzeug - 3.0.3 None
CVE-2023-50782

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

High 7.5 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: cryptography - 42.0.0 None
CVE-2023-49083

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

High 7.5 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: cryptography - 41.0.6 None
CVE-2023-46136

Path to dependency file: /tmp/ws-scm/mergify-engine

Path to vulnerable library: /tmp/ws-scm/mergify-engine

Dependency Hierarchy:

-> ❌ Werkzeug-2.2.3-py3-none-any.whl (Vulnerable Library)

High 7.5 Werkzeug-2.2.3-py3-none-any.whl Upgrade to version: werkzeug - 2.3.8,3.0.1 None
CVE-2023-38325

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

High 7.5 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: cryptography - 41.0.2 None
CVE-2023-30798

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ starlette-0.13.6-py3-none-any.whl (Vulnerable Library)

High 7.5 starlette-0.13.6-py3-none-any.whl Upgrade to version: starlette - 0.25.0 None
CVE-2023-29159

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ starlette-0.13.6-py3-none-any.whl (Vulnerable Library)

High 7.5 starlette-0.13.6-py3-none-any.whl Upgrade to version: starlette - 0.27.0 None
CVE-2021-29510

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ pydantic-1.6.1-cp37-cp37m-manylinux2014_x86_64.whl (Vulnerable Library)

High 7.5 pydantic-1.6.1-cp37-cp37m-manylinux2014_x86_64.whl Upgrade to version: v1.6.2,v1.7.4,v1.8.2 None
CVE-2024-1135

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ gunicorn-21.2.0-py3-none-any.whl (Vulnerable Library)

High 7.4 gunicorn-21.2.0-py3-none-any.whl Upgrade to version: gunicorn - 20.0.1 None
CVE-2023-0286

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

High 7.4 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: openssl-3.0.8;cryptography - 39.0.1;openssl-src - 111.25.0+1.1.1t,300.0.12+3.0.8 None
CVE-2023-2650

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

Medium 6.5 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: OpenSSL_1_1_1u,openssl-3.0.9,openssl-3.1.1, cryptography - 41.0.0 None
CVE-2023-23931

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

Medium 6.5 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: cryptography - 39.0.1 None
CVE-2023-32681

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ requests-2.24.0-py2.py3-none-any.whl (Vulnerable Library)

Medium 6.1 requests-2.24.0-py2.py3-none-any.whl Upgrade to version: requests -2.31.0 None
CVE-2021-33880

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ websockets-8.1-cp37-cp37m-manylinux2010_x86_64.whl (Vulnerable Library)

Medium 5.9 websockets-8.1-cp37-cp37m-manylinux2010_x86_64.whl Upgrade to version: websockets - 9.1 None
CVE-2024-35195

Path to dependency file: /tmp/ws-scm/mergify-engine

Path to vulnerable library: /tmp/ws-scm/mergify-engine

Dependency Hierarchy:

-> ❌ requests-2.31.0-py3-none-any.whl (Vulnerable Library)

Medium 5.6 requests-2.31.0-py3-none-any.whl Upgrade to version: requests - 2.32.2 None
CVE-2024-35195

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ requests-2.24.0-py2.py3-none-any.whl (Vulnerable Library)

Medium 5.6 requests-2.24.0-py2.py3-none-any.whl Upgrade to version: requests - 2.32.2 None
CVE-2023-3446

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

Medium 5.3 cryptography-3.2.1-cp35-abi3-manylinux2010_x86_64.whl Upgrade to version: openssl-3.0.10,openssl-3.1.2, cryptography - 41.0.3 None
CVE-2024-37891

Path to dependency file: /tmp/ws-scm/mergify-engine

Path to vulnerable library: /tmp/ws-scm/mergify-engine

Dependency Hierarchy:

-> ❌ urllib3-2.0.7-py3-none-any.whl (Vulnerable Library)

Medium 4.4 urllib3-2.0.7-py3-none-any.whl Upgrade to version: urllib3 - 1.26.19,2.2.2 None
WS-2023-0138

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

-> ❌ starlette-0.13.6-py3-none-any.whl (Vulnerable Library)

Low 3.7 starlette-0.13.6-py3-none-any.whl Upgrade to version: starlette - 0.27.0 None
CVE-2024-5569

Path to dependency file: /tmp/ws-scm/mergify-engine

Path to vulnerable library: /tmp/ws-scm/mergify-engine,/requirements.txt

Dependency Hierarchy:

-> ❌ zipp-3.15.0-py3-none-any.whl (Vulnerable Library)

Low 3.3 zipp-3.15.0-py3-none-any.whl Upgrade to version: zipp - 3.19.1 None

✔️ Remediated vulnerabilities:

CVE Vulnerable Library
CVE-2023-2650 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2023-0286 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2020-14422 ipaddress-1.0.23-py2.py3-none-any.whl
CVE-2023-49083 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2023-23931 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2023-3446 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2020-36242 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2023-4807 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2023-38325 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl
CVE-2023-50782 cryptography-3.2.1-cp27-cp27mu-manylinux2010_x86_64.whl

Base branch total remaining vulnerabilities: 29
Base branch commit: null


Total libraries scanned: 106

Scan token: 1a9154752653499b9f8863f560429567