Critique
4
Haute
27
Moyenne
27
Faible
5
Inconnue
0
Non affecté
0
Analyse Trivy 0.76.1 des dépendances Python figées dans le fichier requirements de la release, avec la base de vulnérabilités au 2026-11-02. Le runtime Python embarqué par le build n'est pas couvert.
Vulnérabilités (63)
| Sévérité | Identifiant | CVSS | Paquet | Version | Corrigé en | Description | Analyse |
|---|---|---|---|---|---|---|---|
| Critique | CVE-2026-8838 GHSA-29h4-r29x-hchv | 9.8 | redshift-connector transitive | 2.1.12 | 2.1.14 | amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection | Non analysé |
| Critique | CVE-2026-15925 GHSA-5cc2-282f-jjq2 | 9.2 | snowflake-connector-python transitive | 4.3.0 | 3.18.1, 4.7.1 | snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification | Non analysé |
| Critique | GHSA-6q48-6c7w-9gw2 | 9.1 | certifi transitive | 2026.2.25 | 2026.10.18 | certifi bundles emSign root CAs with compromised intermediate CA keys | Non analysé |
| Critique | CVE-2026-102268 GHSA-ffc3-869f-jxw9 | 9.1 | pyjwt transitive | 2.12.1 | 2.14.0 | pyjwt: PyJWT: Authentication bypass via improper public key validation | Non analysé |
| Haute | CVE-2026-27459 GHSA-5pwr-322w-8jr4 | 9.8 | pyopenssl transitive | 25.3.0 | 26.0.0 | pyOpenSSL: DTLS cookie callback buffer overflow | Non analysé |
| Haute | CVE-2026-102267 GHSA-9v7f-9g4p-ffgj | 9.1 | pyjwt transitive | 2.12.1 | 2.14.0 | pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects | Non analysé |
| Haute | CVE-2026-97689 GHSA-vxq7-64xx-v4gw | 8.9 | urllib3 transitive | 2.6.3 | 2.8.0 | urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser | Non analysé |
| Haute | CVE-2026-69249 GHSA-jwv3-5hgf-82ww | 8.7 | cryptography transitive | 46.0.5 | 49.0.0 | python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building | Non analysé |
| Haute | CVE-2026-43871 GHSA-8wv5-x4w7-5gww | 8.7 | thrift transitive | 0.20.0 | 0.24.0 | thrift: Apache Thrift: Denial of Service via infinite loop | Non analysé |
| Haute | CVE-2026-49272 GHSA-3jp2-3mrg-2vxc | 8.5 | oauthlib transitive | 3.3.1 | 4.0.0 | OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow | Non analysé |
| Haute | CVE-2026-118669 GHSA-7984-qgvg-3j9c | 8.4 | oauthlib transitive | 3.3.1 | 4.0.0 | oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers | Non analysé |
| Haute | CVE-2026-69247 GHSA-g6cj-pr64-35w5 | 8.2 | cryptography transitive | 46.0.5 | 50.0.0 | python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing | Non analysé |
| Haute | CVE-2026-97687 GHSA-8988-9cw3-xx77 | 8.1 | urllib3 transitive | 2.6.3 | 2.8.0 | urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override | Non analysé |
| Haute | GHSA-537c-gmf6-5ccf | 7.5 | cryptography transitive | 46.0.5 | 48.0.1 | Vulnerable OpenSSL included in cryptography wheels | Non analysé |
| Haute | CVE-2026-41066 GHSA-vfmq-68hx-4jfw | 7.5 | lxml transitive | 5.4.0 | 6.1.0 | lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read | Non analysé |
| Haute | CVE-2026-119194 GHSA-fm9c-5rcf-2q5p | 7.5 | pyasn1 transitive | 0.6.3 | 0.6.5 | pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding | Non analysé |
| Haute | CVE-2026-119195 GHSA-9m75-vc3g-4x39 | 7.5 | pyasn1 transitive | 0.6.3 | 0.6.5 | pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data | Non analysé |
| Haute | CVE-2026-119196 GHSA-2qm8-x737-gmw5 | 7.5 | pyasn1 transitive | 0.6.3 | 0.6.5 | pyasn1: pyasn1: Denial of Service via constructed bit string decoding | Non analysé |
| Haute | CVE-2026-119197 GHSA-mm57-4v3p-rchx | 7.5 | pyasn1 transitive | 0.6.3 | 0.6.5 | pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding | Non analysé |
| Haute | CVE-2026-59884 GHSA-m4p7-r5rc-7g4j | 7.5 | pyasn1 transitive | 0.6.3 | 0.6.4 | python-pyasn1: pyasn1: Denial of Service via crafted BER input | Non analysé |
| Haute | CVE-2026-59885 GHSA-8ppf-4f7h-5ppj | 7.5 | pyasn1 transitive | 0.6.3 | 0.6.4 | pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER | Non analysé |
| Haute | CVE-2026-59886 GHSA-hm4w-wwcw-mr6r | 7.5 | pyasn1 transitive | 0.6.3 | 0.6.4 | pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values | Non analysé |
| Haute | CVE-2026-49476 GHSA-2wc2-fm75-p42x | 7.5 | soupsieve transitive | 2.8.3 | 2.8.4 | python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string | Non analysé |
| Haute | CVE-2026-49477 GHSA-836r-79rf-4m37 | 7.5 | soupsieve transitive | 2.8.3 | 2.8.4 | soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings | Non analysé |
| Haute | CVE-2026-41608 GHSA-6pjx-3pjc-mrj8 | 7.5 | thrift transitive | 0.20.0 | 0.24.0 | thrift: Apache Thrift Python bindings: Denial of Service via data amplification | Non analysé |
| Haute | CVE-2026-44432 GHSA-mf9v-mfxr-j63j | 7.5 | urllib3 transitive | 2.6.3 | 2.7.0 | urllib3: urllib3: Denial of Service due to excessive HTTP response decompression | Non analysé |
| Haute | CVE-2026-102271 GHSA-p4g4-x82p-q773 | 7.4 | pyjwt transitive | 2.12.1 | 2.14.0 | pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets | Non analysé |
| Haute | CVE-2026-48526 GHSA-xgmm-8j9v-c9wx | 7.4 | pyjwt transitive | 2.12.1 | 2.13.0 | python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens | Non analysé |
| Haute | GHSA-pxh4-856f-4h89 | 7.4 | pyjwt transitive | 2.12.1 | 2.14.0 | PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery | Non analysé |
| Haute | CVE-2026-112940 GHSA-v4x8-3wr5-3wq8 | 7.1 | filelock transitive | 3.25.2 | 4.2.1 | filelock: filelock: Arbitrary file overwrite via insecure database file reopening | Non analysé |
| Haute | CVE-2026-44431 GHSA-qccp-gfcp-xxvc | 5.9 | urllib3 transitive | 2.6.3 | 2.7.0 | urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers | Non analysé |
| Moyenne | CVE-2026-39892 GHSA-p423-j2cm-9vmq | 9.8 | cryptography transitive | 46.0.5 | 46.0.7 | cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API | Non analysé |
| Moyenne | CVE-2026-102275 GHSA-x33g-cr3x-6449 | 8.2 | pyjwt transitive | 2.12.1 | 2.15.0 | pyjwt: PyJWT: Token verification bypass via mismatched OKP key components | Non analysé |
| Moyenne | CVE-2026-101917 GHSA-2gx3-rcp4-g85q | 7.5 | pyjwt transitive | 2.12.1 | 2.14.0 | pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers | Non analysé |
| Moyenne | CVE-2026-101918 GHSA-42vr-xj54-vc7v | 7.5 | pyjwt transitive | 2.12.1 | 2.15.0 | pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload | Non analysé |
| Moyenne | CVE-2026-102274 GHSA-w6j9-cwv2-h6wq | 7.5 | pyjwt transitive | 2.12.1 | 2.14.0 | pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set | Non analysé |
| Moyenne | CVE-2026-69248 GHSA-m2h6-j472-rp4c | 7.4 | cryptography transitive | 46.0.5 | 49.0.0 | python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees | Non analysé |
| Moyenne | CVE-2026-97688 GHSA-gh4c-6fx4-qh6g | 6.9 | urllib3 transitive | 2.6.3 | 2.8.0 | urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding | Non analysé |
| Moyenne | CVE-2026-49265 GHSA-xpv3-w29h-x7cv | 6.8 | oauthlib transitive | 3.3.1 | 4.0.0 | oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery | Non analysé |
| Moyenne | CVE-2026-103001 GHSA-gvp8-978c-rx2q | 6.5 | pyjwt transitive | 2.12.1 | aucun | pyjwt: pyjwt: Token validation bypass via options dictionary mutation | Non analysé |
| Moyenne | CVE-2026-86597 GHSA-qqj6-54q6-cxv6 | 6.5 | snowflake-connector-python transitive | 4.3.0 | 4.7.3 | Snowflake drivers writes sensitive information to logs | Non analysé |
| Moyenne | CVE-2026-112909 GHSA-69hj-f68j-2879 | 6.1 | filelock transitive | 3.25.2 | 4.2.1 | filelock: filelock: arbitrary file truncation via lock path replacement | Non analysé |
| Moyenne | CVE-2026-112936 GHSA-j8f7-rjxc-mr56 | 6.1 | filelock transitive | 3.25.2 | 4.0.9 | filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links | Non analysé |
| Moyenne | CVE-2026-49264 GHSA-hj66-6f7g-4r5v | 6.1 | oauthlib transitive | 3.3.1 | 4.0.0 | oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation | Non analysé |
| Moyenne | CVE-2026-85999 GHSA-j934-xhv5-fg8f | 5.9 | soupsieve transitive | 2.8.3 | 2.9.0 | soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors | Non analysé |
| Moyenne | CVE-2026-86000 GHSA-gjv8-xp57-g29c | 5.9 | soupsieve transitive | 2.8.3 | 2.9.0 | soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors | Non analysé |
| Moyenne | CVE-2026-66053 GHSA-hwrj-9rr4-24xh | 5.9 | thrift transitive | 0.20.0 | 0.24.0 | thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation | Non analysé |
| Moyenne | CVE-2026-112915 GHSA-cwqr-hh33-gh44 | 5.5 | filelock transitive | 3.25.2 | 4.2.1 | filelock: filelock: Denial of Service via crafted SQLite lock database | Non analysé |
| Moyenne | CVE-2026-25645 GHSA-gc5v-m9x4-r6x2 | 5.5 | requests transitive | 2.32.5 | 2.33.0 | requests: Requests: Security bypass due to predictable temporary file creation | Non analysé |
| Moyenne | CVE-2026-102269 GHSA-hxm8-2xgr-2p9m | 5.4 | pyjwt transitive | 2.12.1 | 2.14.0 | pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding | Non analysé |
| Moyenne | CVE-2026-48523 GHSA-jq35-7prp-9v3f | 5.4 | pyjwt transitive | 2.12.1 | 2.13.0 | python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access | Non analysé |
| Moyenne | CVE-2026-112910 GHSA-8mx5-7m5m-r77g | 5.3 | filelock transitive | 3.25.2 | 4.2.1 | filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL | Non analysé |
| Moyenne | CVE-2026-45409 GHSA-65pc-fj4g-8rjx | 5.3 | idna transitive | 3.11 | 3.15 | python-idna: idna: Denial of Service via specially crafted long inputs | Non analysé |
| Moyenne | CVE-2026-48525 GHSA-w7vc-732c-9m39 | 5.3 | pyjwt transitive | 2.12.1 | 2.13.0 | python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens | Non analysé |
| Moyenne | CVE-2026-102270 GHSA-jwrc-g2q2-pq5p | 4.9 | pyjwt transitive | 2.12.1 | 2.14.0 | pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format | Non analysé |
| Moyenne | CVE-2026-112935 GHSA-fq56-3cx3-fjxp | 4.7 | filelock transitive | 3.25.2 | 4.2.1 | filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition | Non analysé |
| Moyenne | CVE-2026-112939 GHSA-rfpc-qcw5-3pc4 | 4.7 | filelock transitive | 3.25.2 | 4.2.1 | filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock | Non analysé |
| Moyenne | CVE-2026-48522 GHSA-993g-76c3-p5m4 | 4.2 | pyjwt transitive | 2.12.1 | 2.13.0 | python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient | Non analysé |
| Faible | CVE-2026-48524 GHSA-fhv5-28vv-h8m8 | 5.9 | pyjwt transitive | 2.12.1 | 2.13.0 | python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs | Non analysé |
| Faible | CVE-2026-27448 GHSA-vp96-hxj8-p424 | 5.4 | pyopenssl transitive | 25.3.0 | 26.0.0 | pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback | Non analysé |
| Faible | CVE-2026-34073 GHSA-m959-cc7f-wv43 | 5.3 | cryptography transitive | 46.0.5 | 46.0.6 | python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation | Non analysé |
| Faible | CVE-2026-112913 GHSA-9vhv-jxww-xfm5 | 3.3 | filelock transitive | 3.25.2 | 4.2.1 | filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database | Non analysé |
| Faible | CVE-2026-112907 GHSA-567q-5qvw-pf92 | 2.5 | filelock transitive | 3.25.2 | 4.2.1 | filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break | Non analysé |
Téléchargements
Licences des dépendances
non déterminées