Critique
0
Haute
4
Moyenne
2
Faible
1
Inconnue
0
Non affecté
0
Analyse Trivy 0.76.1 des dépendances Python figées dans le fichier requirements de la release, avec la base de vulnérabilités au 2026-11-02. Le runtime Python embarqué par le build n'est pas couvert.
Dépendances sans version figée, non analysées : setuptools, psycopg2-binary, nzpy.
Vulnérabilités (7)
| Sévérité | Identifiant | CVSS | Paquet | Version | Corrigé en | Description | Analyse |
|---|---|---|---|---|---|---|---|
| Haute | CVE-2026-26007 GHSA-r6ph-v2qm-q3c2 | 8.2 | cryptography transitive | 41.0.7 | 46.0.5 | cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves | Non analysé |
| Haute | CVE-2023-50782 GHSA-3ww4-gg4f-jr7f | 7.5 | cryptography transitive | 41.0.7 | 42.0.0 | python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659 | Non analysé |
| Haute | CVE-2024-26130 GHSA-6vqw-3v5j-54x4 | 7.5 | cryptography transitive | 41.0.7 | 42.0.4 | python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override | Non analysé |
| Haute | GHSA-537c-gmf6-5ccf | 7.5 | cryptography transitive | 41.0.7 | 48.0.1 | Vulnerable OpenSSL included in cryptography wheels | Non analysé |
| Moyenne | CVE-2024-0727 GHSA-9v9h-cgj8-h64p | 5.5 | cryptography transitive | 41.0.7 | 42.0.2 | openssl: denial of service via null dereference | Non analysé |
| Moyenne | GHSA-h4gh-qq45-vh27 | cryptography transitive | 41.0.7 | 43.0.1 | pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels | Non analysé | |
| Faible | CVE-2026-34073 GHSA-m959-cc7f-wv43 | 5.3 | cryptography transitive | 41.0.7 | 46.0.6 | python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation | Non analysé |
Téléchargements
Licences des dépendances
non déterminées