Moderate: python3.11-pip security update

pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python". Security Fixes: python: tarfile...

Improper Input Validation

pdm is vulnerable to Improper Input Validation. The vulnerability exists in the readlockfile function at repositories.py due to lack of input validations which allows an attacker to trick a user into installing a malicious open source PyPi package...

python27:2.7 security update

babel Cython numpy pytest python2 2.7.18-13.0.1.2 - Security fix for CVE-2023-40217 python2-pip python2-rpm-macros python2-setuptools python2-six python-attrs python-backports python-backports-sslmatchhostname python-chardet python-coverage python-dns python-docs python-docutils python-funcsigs...

MAL-2023-8399 Malicious code in fbdebug (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2edf3045263e059e2b1599655b25cc167abecc4d1e77e5e7e8d62998b0fd9e18 The OpenSSF Package Analysis project identified 'fbdebug' @ 0.1 pypi as malicious. It is considered malicious because: - The package communicate...

PDM Trojan Lockfile

Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...

CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

Design/Logic Flaw

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

CVE-2023-45805

CVE-2023-45805 affects the Python tool PDM (dependency manager). A crafted pawns-style lockfile in which a project like foo is targeted with foo-2 and a file foo-2-2.tar.gz can mislead PyPI and PDM into installing a different project than what appears in pyproject.toml, potentially allowing arbit...

CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

MAL-2023-8370 Malicious code in tencent-cloud-python-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security bf236cca18e4d157a57cd3de7abed8ad967103c42b9ae53f5026174af46b64a4 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8362 Malicious code in python-alibabacloud-sdk-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1384f0a4ed6515eb7e720621346f74f53217b73863f4c5e3cda4fc90b52f49e3 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8359 Malicious code in aws-enumerate-iam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 96d7eea455989a7a10bf2fafd9f9c4a2d5d9a4c2a3ec852e424885f3e51c5edb Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8361 Malicious code in enumerate-iam-aws (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 46f8fde812a7274ad1e270e0cc3a8698349365af5d85ee9b89248fa467e5bf2f Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8363 Malicious code in python-alibabacloud-tea-openapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1a75cd94261db49f7ab1e359b2579e7645756a48f20eb6a49465f980f5c2b43d Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8355 Malicious code in alisdkcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 456242a426a17eeaca869a5f00ee2f02d837dec5bba7da9240b6bec77c0ae8a8 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8310 Malicious code in cephlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f82a5ba62b790856947d686397170162bf743b168fd9d66008ed6501b465d5af The OpenSSF Package Analysis project identified 'cephlib' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8309 Malicious code in xmlbuilder3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5ccc40a08ace658e1c2bb67a692e4a04f1c6c826a6cfbf7c2bec41d0f54c540 The OpenSSF Package Analysis project identified 'xmlbuilder3' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...