Skip to content

Commit

Permalink
Bump Babel to fix security issue
Browse files Browse the repository at this point in the history
   +==============================================================================+
  |                                                                              |
  |                               /$$$$$$            /$$                         |
  |                              /$$__  $$          | $$                         |
  |           /$$$$$$$  /$$$$$$ | $$  \__//$$$$$$  /$$$$$$   /$$   /$$           |
  |          /$$_____/ |____  $$| $$$$   /$$__  $$|_  $$_/  | $$  | $$           |
  |         |  $$$$$$   /$$$$$$$| $$_/  | $$$$$$$$  | $$    | $$  | $$           |
  |          \____  $$ /$$__  $$| $$    | $$_____/  | $$ /$$| $$  | $$           |
  |          /$$$$$$$/|  $$$$$$$| $$    |  $$$$$$$  |  $$$$/|  $$$$$$$           |
  |         |_______/  \_______/|__/     \_______/   \___/   \____  $$           |
  |                                                          /$$  | $$           |
  |                                                         |  $$$$$$/           |
  |  by pyup.io                                              \______/            |
  |                                                                              |
  +==============================================================================+
  | REPORT                                                                       |
  | checked 25 packages, using free DB (updated once a month)                    |
  +============================+===========+==========================+==========+
  | package                    | installed | affected                 | ID       |
  +============================+===========+==========================+==========+
  | babel                      | 2.8.0     | <2.9.1                   | 42203    |
  +==============================================================================+
  | Babel 2.9.1 includes a fix for CVE-2021-42771: Babel.Locale in Babel before  |
  | 2.9.1 allows attackers to load arbitrary locale .dat files (containing       |
  | serialized Python objects) via directory traversal, leading to code          |
  | execution.                                                                   |
  | python-babel/babel#782                               |
  | https://lists.debian.org/debian-lts/2021/10/msg00040.html                    |
  | https://www.tenable.com/security/research/tra-2021-14                        |
  | https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html           |
  +==============================================================================+
  • Loading branch information
sbrunner committed Nov 12, 2021
1 parent 1de0be2 commit 21b1636
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 5 deletions.
2 changes: 1 addition & 1 deletion doc/Pipfile
Expand Up @@ -9,7 +9,7 @@ Pygments = "==2.4.0"
Sphinx = "==3.0.4"
sphinx-prompt = "==1.1.0"
# Lock
babel = "==2.8.0"
babel = "==2.9.1"
certifi = "==2019.11.28"
chardet = "==3.0.4"
docutils = "==0.16"
Expand Down
8 changes: 4 additions & 4 deletions doc/Pipfile.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 21b1636

Please sign in to comment.