Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

CVE-2023-45805 Trojan Lockfilein pdm

pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project f...

[SECURITY] Fedora 38 Update: composer-2.6.5-1.fc38

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

SUSE-SU-2023:3861-1 Security update for SUSE Manager Server 4.3

This update fixes the following issues: billing-data-service: - Version 0.3-1 Add required dependencies to package and service Change billing api datastructure Require csp-billing-adapter service cobbler: - Fix EFI PXE boot regression bsc1214124 - Fix isolinux.cfg generation in 'cobbler buildiso'...

[SECURITY] Fedora 37 Update: yarnpkg-1.22.19-5.fc37

Fast, reliable, and secure dependency management...

[SECURITY] Fedora 36 Update: yarnpkg-1.22.19-5.fc36

Fast, reliable, and secure dependency management...

[SECURITY] Fedora 38 Update: yarnpkg-1.22.19-5.fc38

Fast, reliable, and secure dependency management...

Fedora: Security Advisory for yarnpkg (FEDORA-2023-ce8943223c)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 37 Update: yarnpkg-1.22.19-3.fc37

Fast, reliable, and secure dependency management...

[SECURITY] Fedora 37 Update: yarnpkg-1.22.19-2.fc37

Fast, reliable, and secure dependency management...

[SECURITY] Fedora 36 Update: yarnpkg-1.22.19-2.fc36

Fast, reliable, and secure dependency management...

Xxe

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity XXE attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML SNAPSHOT versions are being resolved...

GHSA-8G2P-5PQH-5JMC .NET Information Disclosure Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages. A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a...

CVE-2022-36070

Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. git config. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to th...

Poetry 代码问题漏洞

Poetry is a tool for dependency management and packaging in Python. It allows you to declare the libraries on which your project depends and will manage install/update them for you. A code issue vulnerability exists in Poetry versions prior to 1.1.9 and prior to 1.2.0b1 that stems from the...

[SECURITY] Fedora 36 Update: composer-2.3.5-1.fc36

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

Spring Cloud Azure 4.0 is Now Generally Available

NOTE: Hi, Spring fans! This is a guest post from Sean Li, our friend at Microsoft I am pleased to announce that Spring Cloud Azure 4.0 is now generally available. With this major release we aim to bring better security, leaner dependencies, support for production readiness and more. Version 4...

[SECURITY] Fedora 34 Update: cabal-rpm-2.0.11-1.fc34

This package provides a RPM packaging tool for Haskell Cabal-based packages. cabal-rpm has commands to generate a RPM spec file and srpm for a package. It can rpmbuild packages, yum/dnf install their dependencies, prep packages, and install them. There are commands to list package dependencies an...

SUSE-SU-2021:4104-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2021-3426: Fixed information disclosure via pydoc bsc1183374. - CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from the server bsc1189241. - CVE-2021-3737: Fixed ReDoS in urllib.request...

SUSE-SU-2021:2940-1 Security update for python39

This update for python39 fixes the following issues: - CVE-2021-29921: Fixed improper input validation of octal string IP addresses bsc1185706. - Use versioned python-Sphinx to avoid dependency on other version of Python bsc1183858. - Stop providing 'python' symbol bsc1185588, which means python2...