Skip to content

Commit a307157

Browse files
keshav-spacemichaelehab
keshav-space
authored and
michaelehab
committed
Bump univers to v30.12.0
Signed-off-by: Keshav Priyadarshi <git@keshav.space> Signed-off-by: Michael Ehab Mikhail <michael.ehab@hotmail.com>
1 parent 0ef9bf8 commit a307157

3 files changed

Lines changed: 204 additions & 2 deletions

File tree

‎requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ toml==0.10.2
106106
tomli==2.0.1
107107
traitlets==5.1.1
108108
typing_extensions==4.1.1
109-
univers==30.11.0
109+
univers==30.12.0
110110
urllib3==1.26.19
111111
wcwidth==0.2.5
112112
websocket-client==0.59.0

‎setup.cfg‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ install_requires =
7171

7272
#essentials
7373
packageurl-python>=0.10.5rc1
74-
univers>=30.11.0
74+
univers>=30.12.0
7575
license-expression>=21.6.14
7676

7777
# file and data formats

‎vulnerabilities/tests/test_data/apache_kafka/apache-kafka-improver-expected.json‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,206 @@
11
[
2+
{
3+
"vulnerability_id": null,
4+
"aliases": [
5+
"CVE-2021-38153"
6+
],
7+
"confidence": 100,
8+
"summary": "Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed.",
9+
"affected_purls": [
10+
{
11+
"type": "apache",
12+
"namespace": "",
13+
"name": "kafka",
14+
"version": "1.1.0",
15+
"qualifiers": "",
16+
"subpath": ""
17+
},
18+
{
19+
"type": "apache",
20+
"namespace": "",
21+
"name": "kafka",
22+
"version": "1.1.1",
23+
"qualifiers": "",
24+
"subpath": ""
25+
},
26+
{
27+
"type": "apache",
28+
"namespace": "",
29+
"name": "kafka",
30+
"version": "1.1.2",
31+
"qualifiers": "",
32+
"subpath": ""
33+
},
34+
{
35+
"type": "apache",
36+
"namespace": "",
37+
"name": "kafka",
38+
"version": "1.1.3",
39+
"qualifiers": "",
40+
"subpath": ""
41+
},
42+
{
43+
"type": "apache",
44+
"namespace": "",
45+
"name": "kafka",
46+
"version": "1.1.4",
47+
"qualifiers": "",
48+
"subpath": ""
49+
},
50+
{
51+
"type": "apache",
52+
"namespace": "",
53+
"name": "kafka",
54+
"version": "1.1.5",
55+
"qualifiers": "",
56+
"subpath": ""
57+
},
58+
{
59+
"type": "apache",
60+
"namespace": "",
61+
"name": "kafka",
62+
"version": "1.1.6",
63+
"qualifiers": "",
64+
"subpath": ""
65+
},
66+
{
67+
"type": "apache",
68+
"namespace": "",
69+
"name": "kafka",
70+
"version": "1.1.7",
71+
"qualifiers": "",
72+
"subpath": ""
73+
},
74+
{
75+
"type": "apache",
76+
"namespace": "",
77+
"name": "kafka",
78+
"version": "1.1.8",
79+
"qualifiers": "",
80+
"subpath": ""
81+
}
82+
],
83+
"fixed_purl": null,
84+
"references": [
85+
{
86+
"reference_id": "CVE-2021-38153",
87+
"url": "https://kafka.apache.org/cve-list",
88+
"severities": []
89+
},
90+
{
91+
"reference_id": "CVE-2021-38153",
92+
"url": "https://kafka.apache.org/cve-list#CVE-2021-38153",
93+
"severities": []
94+
},
95+
{
96+
"reference_id": "CVE-2021-38153",
97+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153",
98+
"severities": []
99+
}
100+
],
101+
"weaknesses": []
102+
},
103+
{
104+
"vulnerability_id": null,
105+
"aliases": [
106+
"CVE-2019-12399"
107+
],
108+
"confidence": 100,
109+
"summary": "When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value (the externalized secret variable is not the whole configuration property value), then any client can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret rather than the externalized secrets variable. Users should upgrade to 2.2.2 or higher, or 2.3.1 or higher where this vulnerability has been fixed.",
110+
"affected_purls": [
111+
{
112+
"type": "apache",
113+
"namespace": "",
114+
"name": "kafka",
115+
"version": "1.1.0",
116+
"qualifiers": "",
117+
"subpath": ""
118+
},
119+
{
120+
"type": "apache",
121+
"namespace": "",
122+
"name": "kafka",
123+
"version": "1.1.1",
124+
"qualifiers": "",
125+
"subpath": ""
126+
},
127+
{
128+
"type": "apache",
129+
"namespace": "",
130+
"name": "kafka",
131+
"version": "1.1.2",
132+
"qualifiers": "",
133+
"subpath": ""
134+
},
135+
{
136+
"type": "apache",
137+
"namespace": "",
138+
"name": "kafka",
139+
"version": "1.1.3",
140+
"qualifiers": "",
141+
"subpath": ""
142+
},
143+
{
144+
"type": "apache",
145+
"namespace": "",
146+
"name": "kafka",
147+
"version": "1.1.4",
148+
"qualifiers": "",
149+
"subpath": ""
150+
},
151+
{
152+
"type": "apache",
153+
"namespace": "",
154+
"name": "kafka",
155+
"version": "1.1.5",
156+
"qualifiers": "",
157+
"subpath": ""
158+
},
159+
{
160+
"type": "apache",
161+
"namespace": "",
162+
"name": "kafka",
163+
"version": "1.1.6",
164+
"qualifiers": "",
165+
"subpath": ""
166+
},
167+
{
168+
"type": "apache",
169+
"namespace": "",
170+
"name": "kafka",
171+
"version": "1.1.7",
172+
"qualifiers": "",
173+
"subpath": ""
174+
},
175+
{
176+
"type": "apache",
177+
"namespace": "",
178+
"name": "kafka",
179+
"version": "1.1.8",
180+
"qualifiers": "",
181+
"subpath": ""
182+
}
183+
],
184+
"fixed_purl": null,
185+
"references": [
186+
{
187+
"reference_id": "CVE-2019-12399",
188+
"url": "https://kafka.apache.org/cve-list",
189+
"severities": []
190+
},
191+
{
192+
"reference_id": "CVE-2019-12399",
193+
"url": "https://kafka.apache.org/cve-list#CVE-2019-12399",
194+
"severities": []
195+
},
196+
{
197+
"reference_id": "CVE-2019-12399",
198+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12399",
199+
"severities": []
200+
}
201+
],
202+
"weaknesses": []
203+
},
2204
{
3205
"vulnerability_id": null,
4206
"aliases": [

0 commit comments

Comments
 (0)