schnipdip / raisensu Goto Github PK
View Code? Open in Web Editor NEWA simple license asset management tool.
License: Other
A simple license asset management tool.
License: Other
File:
raisensu.py
Code:
cursor.execute('''UPDATE ASSETS SET ? = '?' WHERE ID = ?''', (updateColumn, setValue, updateIndex))
Return:
Traceback (most recent call last):
File "main.py", line 149, in <module>
update_asset()
File "main.py", line 99, in update_asset
cursor.execute('''UPDATE ASSETS SET ? = '?' WHERE ID = ?''', (updateColumn, setValue, updateIndex))
sqlite3.OperationalError: near "?": syntax error
Support a backend remote postgres database.
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/ed/b8/79858c68bafa7517c20859334ad270fe0c174a65c1ab80a9b8b377e7584b/cryptography-3.1.1-cp27-cp27mu-manylinux2010_x86_64.whl
Path to dependency file: /windows/requirements.txt
Path to vulnerable library: /windows/requirements.txt,/linux/requirements.txt
Dependency Hierarchy:
Found in base branch: master
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates
or load_der_pkcs7_certificates
could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Publish Date: 2023-11-29
URL: CVE-2023-49083
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-49083
Release Date: 2023-11-29
Fix Resolution: cryptography - 41.0.6
Step up your Open Source Security Game with Mend here
Add a description field.
File:
raisensu_monitor.py
Issue:
If a date is returned and it matches a valid expiration time, the date is returned to notify
, but it won't return any other matches because it breaks out of the loop.
Possible Solution:
Return objects with yield
Add an env field for where the license/host is deployed.
Implement systemd service to support HA.
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/ed/b8/79858c68bafa7517c20859334ad270fe0c174a65c1ab80a9b8b377e7584b/cryptography-3.1.1-cp27-cp27mu-manylinux2010_x86_64.whl
Path to dependency file: /windows/requirements.txt
Path to vulnerable library: /windows/requirements.txt,/linux/requirements.txt
Dependency Hierarchy:
Found in base branch: master
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into
would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as bytes
) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since update_into
was originally introduced in cryptography 1.8.
Publish Date: 2023-02-07
URL: CVE-2023-23931
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-23931
Release Date: 2023-02-07
Fix Resolution: 39.0.1
Step up your Open Source Security Game with Mend here
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/ed/b8/79858c68bafa7517c20859334ad270fe0c174a65c1ab80a9b8b377e7584b/cryptography-3.1.1-cp27-cp27mu-manylinux2010_x86_64.whl
Path to dependency file: /windows/requirements.txt
Path to vulnerable library: /windows/requirements.txt,/linux/requirements.txt
Dependency Hierarchy:
Found in base branch: master
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.
Publish Date: 2021-02-07
URL: CVE-2020-36242
Base Score Metrics:
Step up your Open Source Security Game with Mend here
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/ed/b8/79858c68bafa7517c20859334ad270fe0c174a65c1ab80a9b8b377e7584b/cryptography-3.1.1-cp27-cp27mu-manylinux2010_x86_64.whl
Path to dependency file: /windows/requirements.txt
Path to vulnerable library: /windows/requirements.txt,/linux/requirements.txt
Dependency Hierarchy:
Found in base branch: master
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
Publish Date: 2021-01-11
URL: CVE-2020-25659
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-hggm-jpg3-v476
Release Date: 2021-01-11
Fix Resolution: 3.2
Step up your Open Source Security Game with Mend here
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/ed/b8/79858c68bafa7517c20859334ad270fe0c174a65c1ab80a9b8b377e7584b/cryptography-3.1.1-cp27-cp27mu-manylinux2010_x86_64.whl
Path to dependency file: /windows/requirements.txt
Path to vulnerable library: /windows/requirements.txt,/linux/requirements.txt
Dependency Hierarchy:
Found in base branch: master
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
Publish Date: 2023-07-14
URL: CVE-2023-38325
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-38325
Release Date: 2023-07-14
Fix Resolution: 41.0.2
Step up your Open Source Security Game with Mend here
Powerful data structures for data analysis, time series, and statistics
Library home page: https://files.pythonhosted.org/packages/db/83/7d4008ffc2988066ff37f6a0bb6d7b60822367dcb36ba5e39aa7801fda54/pandas-0.24.2-cp27-cp27mu-manylinux1_x86_64.whl
Path to dependency file: Raisensu/windows/requirements.txt
Path to vulnerable library: Raisensu/windows/requirements.txt,Raisensu/linux/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 09a5988efb8b45dd00f81a8e33f09bec222e45dd
Found in base branch: master
** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner.
Publish Date: 2020-05-15
URL: CVE-2020-13091
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-13091
Release Date: 2020-05-19
Fix Resolution: pandas - 0.3.0.beta,1.0.4;autovizwidget - 0.12.7;pandas - 1.0.4,1.1.0rc0
Step up your Open Source Security Game with WhiteSource here
IPv4/IPv6 manipulation library
Library home page: https://files.pythonhosted.org/packages/c2/f8/49697181b1651d8347d24c095ce46c7346c37335ddc7d255833e7cde674d/ipaddress-1.0.23-py2.py3-none-any.whl
Path to dependency file: /linux/requirements.txt
Path to vulnerable library: /linux/requirements.txt,/windows/requirements.txt
Dependency Hierarchy:
Found in base branch: master
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
Publish Date: 2020-06-18
URL: CVE-2020-14422
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422
Release Date: 2020-06-18
Fix Resolution: v3.5.10,v3.6.12,v3.7.9,v3.8.4v3.9.0
Step up your Open Source Security Game with Mend here
Issue:
It's better to have the secret.key file be generated from the generate_key.py
file. When cloning secret.key
file from github it contains a single bit. That bit throws off the conditional check if os.stat(key_file).st_size == 0:
.
Resolution:
Delete secret.key file
Reference Issue #5
cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Library home page: https://files.pythonhosted.org/packages/ed/b8/79858c68bafa7517c20859334ad270fe0c174a65c1ab80a9b8b377e7584b/cryptography-3.1.1-cp27-cp27mu-manylinux2010_x86_64.whl
Path to dependency file: /windows/requirements.txt
Path to vulnerable library: /windows/requirements.txt,/linux/requirements.txt
Dependency Hierarchy:
Found in base branch: master
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.
Publish Date: 2023-02-08
URL: CVE-2023-0286
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-x4qr-2fvf-3mr5
Release Date: 2023-02-08
Fix Resolution: openssl-3.0.8;cryptography - 39.0.1;openssl-src - 111.25.0+1.1.1t,300.0.12+3.0.8
Step up your Open Source Security Game with Mend here
NumPy is the fundamental package for array computing with Python.
Library home page: https://files.pythonhosted.org/packages/3a/5f/47e578b3ae79e2624e205445ab77a1848acdaa2929a00eeef6b16eaaeb20/numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl
Path to dependency file: /linux/requirements.txt
Path to vulnerable library: /linux/requirements.txt,/windows/requirements.txt
Dependency Hierarchy:
Found in base branch: master
** DISPUTED ** Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally).
Mend Note: After conducting further research, Mend has determined that numpy versions before 1.22.0 are vulnerable to CVE-2021-41496
Publish Date: 2021-12-17
URL: CVE-2021-41496
Base Score Metrics:
Step up your Open Source Security Game with Mend here
file:
raisensu.py
code:
sql_update = "UPDATE ASSETS SET {0} = '{1}' WHERE ID = {2}".format(updateColumn, key_object.encrypt(setValue), updateIndex)
issue:
when updating the license column, a syntax error is thrown.
It would be nice to select licenses by hostname, name, id, expires, environment, description.
So if a user wants to only view the licenses in the dev environment, they can return those objects from the database.
NumPy is the fundamental package for array computing with Python.
Library home page: https://files.pythonhosted.org/packages/3a/5f/47e578b3ae79e2624e205445ab77a1848acdaa2929a00eeef6b16eaaeb20/numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl
Path to dependency file: /linux/requirements.txt
Path to vulnerable library: /linux/requirements.txt,/windows/requirements.txt
Dependency Hierarchy:
Found in base branch: master
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Mend Note: After conducting further research, Mend has determined that versions 1.12.0 through 1.21.6 of numpy are vulnerable to CVE-2021-34141
Publish Date: 2021-12-17
URL: CVE-2021-34141
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34141
Release Date: 2021-12-17
Fix Resolution (numpy): 1.22.0
Direct dependency fix Resolution (pandas): 0.25.0
Step up your Open Source Security Game with Mend here
NumPy is the fundamental package for array computing with Python.
Library home page: https://files.pythonhosted.org/packages/3a/5f/47e578b3ae79e2624e205445ab77a1848acdaa2929a00eeef6b16eaaeb20/numpy-1.16.6-cp27-cp27mu-manylinux1_x86_64.whl
Path to dependency file: /linux/requirements.txt
Path to vulnerable library: /linux/requirements.txt,/windows/requirements.txt
Dependency Hierarchy:
Found in base branch: master
** DISPUTED ** A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.
Mend Note: After conducting further research, Mend has determined that numpy versions before 1.21.0 are vulnerable to CVE-2021-33430
Publish Date: 2021-12-17
URL: CVE-2021-33430
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-33430
Release Date: 2021-12-17
Fix Resolution (numpy): 1.21.0
Direct dependency fix Resolution (pandas): 0.25.0
Step up your Open Source Security Game with Mend here
Issue:
Create the secret.key
file if it doesn't already exist.
Possible Resolution:
with open('secret.key', 'wb+') as key_file:
if os.stat(key_file).st_size == 0:
key_file.write(key)
else:
print ('''Key already exits. If you want to generate a new key delete the key in the secrets.key file.''')
exit(0)
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.