PT-2024-40490 · Pypi · Pyo3

Name of the Vulnerable Software and Affected Versions: PyO3 versions 0.23.0 through 0.23.2 Description: The issue arises from a regression in the PYO3 CONFIG FILE environment variable, which is used to configure builds. This regression causes PyO3 to fail to reconfigure and recompile when the...

@angular-devkit/build-angular (>=18.0.0-next.0, <=18.1.0-next.2), @angular/build (>=18.0.0-next.3, <=18.1.0-next.2) +99 more potentially affected by CVE-2024-45812 via vite (>=5.2.0, <=5.2.13)

vite NPM version =5.2.0, =18.0.0-next.0, =18.0.0-next.3, =0.36.1-fix1, =0.21.1, =1.0.375, =1.1.0, =5.0.0-alpha.4, =0.1.0-rc.8, =0.0.3, =0.0.22, =18.0.0-next.1, =18.0.0-next.1, =3.0.2, =3.2.12 and more Source cves: CVE-2024-45812 Source advisory: OSV:GHSA-64VR-G452-QVP3...

@angular-architects/build-angular (16.2.0-next.2), @angular-devkit/build-angular (>=15.1.0-next.0, <=17.3.1) +165 more potentially affected by CVE-2024-29180 via webpack-dev-middleware (>=6.0.0, <=6.1.1)

webpack-dev-middleware NPM version =6.0.0, =15.1.0-next.0, =9.3.0, =1.12.3, =4.20.4, =0.1.0, =3.1.0-0, =3.0.0-alpha.14, =15.1.0-snapshot-1674521814202, =16.0.0-next.6, =2.6.0, =8.4.0-rc.2, =7.0.0-rc.11, =7.0.0-rc.16 and more Source cves: CVE-2024-29180 Source advisory: OSV:GHSA-WR3J-PWJ9-HQQ6...

[SECURITY] Fedora 40 Update: opentest4j-1.3.0-6.fc40

Open Test Alliance for the JVM is a minimal common foundation for testing libraries on the JVM. The primary goal of the project is to enable testing frameworks like JUnit, TestNG, Spock, etc. and third-party assertion libraries like Hamcrest, AssertJ, etc. to use a common set of exceptions that...

@attq/blackboox (>=0.4.0, <=0.5.5), @overwolf/ow-electron-builder (>=24.7.0-beta.0, <=24.7.0) +10 more potentially affected by CVE-2024-27303 via app-builder-lib (>=24.0.0-alpha.1, <=24.13.1)

app-builder-lib NPM version =24.0.0-alpha.1, =0.4.0, =24.7.0-beta.0, =1.0.0-canary.0, =24.6.3, =24.0.0-alpha.1, =24.0.0-alpha.1, =24.0.0-alpha.1, =1.0.0, =24.0.0-alpha.1, =24.0.0-alpha.1, =24.0.0-alpha.1, =24.0.0-alpha.1, =24.13.1 Source cves: CVE-2024-27303 Source advisory: OSV:GHSA-R4PF-3V7R-HH...

From Spring Native to Spring Boot 3

Today, we are finishing to transition the Spring support for building native executables from the experimental Spring Native project to the official Spring Boot GraalVM native image support. In practice, that means we are archiving the Spring Native GitHub repository and moving it to the...

XXE vulnerability on agents in Jenkins SourceMonitor Plugin

SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML input files for the 'Publish SourceMonitor results' post-build step to have agent processes parse a crafted file that uses external entities...

A Bootiful Podcast: Google mad scientist Josh Suereth on Observability with OpenTelemetry, building better build tools, and so much more

Hi, Spring fans! In this installment, Josh Long @starbuxman looks at the latest and greatest in Spring Boot 3 AOT, then talks to Googles Josh Suereth @jsuereth about observability with OpenTelemetry, building better build tools, and so much more. Want to learn more about Spring Boot and the wider...

@alfresco/adf-testing (6.0.0-A.2-8258), @angular-architects/build-angular (14.2.0-next.0) +54 more potentially affected by CVE-2022-37599 via loader-utils (>=3.0.0, <=3.2.0)

loader-utils NPM version =3.0.0, =0.9.2, =13.0.0-rc.2, =1.0.0, =1.3.1, =13.0.0-rc.18, =3.9.0-beta.1, =13.0.0, =0.1.0, =1.7.4, =4.7.1-beta.0, =4.7.1-beta.0, =9.1.3-beta.1 and more Source cves: CVE-2022-37599 Source advisory: OSV:GHSA-HHQ3-FF78-JV3G...

Native Support in Spring Boot 3.0.0-M5

The Spring Team has been working on native image support for Spring Applications for quite some time. After 3+ years of incubation in the Spring Native experimental project with Spring Boot 2, native support is moving to General Availability with Spring Framework 6 and Spring Boot 3! Native image...

[SECURITY] Fedora 36 Update: golang-x-mobile-0-0.13.20220719git8578da9.fc36

The Go mobile repository holds packages and build tools for using Go on mobile platforms...

Malicious code in usaa-nw-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f8770fd569e77308417d4270871ab91fb9903d97683fd91c6e3259e6950bd2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6848 Malicious code in usaa-nw-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f8770fd569e77308417d4270871ab91fb9903d97683fd91c6e3259e6950bd2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opbox-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de28bacc1f61f09e5b27ca443c3518a782a3fa7286a891c60d87b35c5c1c1db4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5088 Malicious code in opbox-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de28bacc1f61f09e5b27ca443c3518a782a3fa7286a891c60d87b35c5c1c1db4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

cargo-apk (>=0.3.1, <=0.4.0), cargo-authors (>=0.0.1, <=0.4.0) +30 more potentially affected by CVE-2019-16760 via cargo (>=0.4.0, <=0.26.0)

cargo CARGO version =0.4.0, =0.3.1, =0.0.1, =0.1.0, =0.1.0, =0.2.2, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.3.1, =0.1.0, =0.5.1, =0.1.0, =0.2.1 and more Source cves: CVE-2019-16760 Source advisory: OSV:GHSA-9F3P-WVJ7-Q82X...

Unspecified Vulnerability in Gradle Enterprise

Gradle is the U.S. Gradle company's set of JVM-based project build tool , it supports maven, Ivy repository and so on. Gradle Enterprise prior to 2021.4.2 suffers from a security vulnerability that stems from the default built-in build cache configuration allowing anonymous write access. If this...

com.github.j5ik2o:grpc-gateway-runtime_2.12 (>=1.0.0, <=1.0.3), com.github.j5ik2o:grpc-gateway-runtime_2.13 (>=1.0.0, <=1.0.3) +2 more potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (3.19.4)

org.webjars:swagger-ui MAVEN version 3.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.github.j5ik2o:grpc-gateway-runtime2.12 =1.0.0, =1.0.0, =2.0.11, =2.1.2 Source cves: CVE-2018-25031 Source...

org.apache.cxf.systests:cxf-systests-jaxrs (>=3.2.6, <=3.2.10), org.apache.syncope.fit:syncope-fit-build-tools (>=2.0.10, <=2.1.1) potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (3.17.6)

org.webjars:swagger-ui MAVEN version 3.17.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - org.apache.cxf.systests:cxf-systests-jaxrs =3.2.6, =2.0.10, =2.1.1 Source cves: CVE-2018-25031 Source advisory:...

org.apache.syncope.fit:syncope-fit-build-tools (>=2.0.9, <=2.1.0), org.jooby:jooby-apitool (>=1.5.0, <=1.6.9) +1 more potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (3.17.1)

org.webjars:swagger-ui MAVEN version 3.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - org.apache.syncope.fit:syncope-fit-build-tools =2.0.9, =1.5.0, =1.5.0, =1.6.9 Source cves: CVE-2018-25031 Source...