mirror of
https://github.com/saltstack/salt.git
synced 2025-04-17 10:10:20 +00:00
db49815052
Vulnerable versions: >= 3.1, < 3.3.2 Patched version: 3.3.2 Impact: When certain sequences of update() calls with large values (multiple GBs) for symetric encryption or decryption occur, it's possible for an integer overflow to happen, leading to mishandling of buffers. References: - pyca/cryptography#5615 For Py3.5 requirements we dropped `cryptography` to version 3.0 which is not vulnerable to the CVE in question. This decision was made consciously because the Salt Project creates packages for the supported distributions which still use Py3.5 and those even rely on an even older version of `cryptography`. Upgrading to the latest version was not possible because the `cryptography` project dropped Py3.5 support.
55 lines
1.5 KiB
Text
55 lines
1.5 KiB
Text
#
|
|
# This file is autogenerated by pip-compile
|
|
# To update, run:
|
|
#
|
|
# pip-compile -o requirements/static/pkg/py3.5/windows.txt -v requirements/windows.txt requirements/static/pkg/windows.in
|
|
#
|
|
backports.ssl-match-hostname==3.7.0.1 ; python_version < "3.7"
|
|
certifi==2020.6.20
|
|
cffi==1.12.2
|
|
chardet==3.0.4 # via requests
|
|
cheroot==8.3.0 # via cherrypy
|
|
cherrypy==17.4.1
|
|
contextlib2==0.6.0.post1 # via cherrypy
|
|
contextvars==2.4 ; python_version < "3.7"
|
|
cryptography==3.0
|
|
distro==1.5.0
|
|
gitdb==4.0.5 # via gitpython
|
|
gitpython==3.1.12
|
|
idna==2.8
|
|
immutables==0.14 # via contextvars
|
|
ioloop==0.1a0
|
|
jaraco.functools==2.0 # via cheroot, tempora
|
|
jinja2==2.10.1
|
|
libnacl==1.7.1
|
|
lxml==4.6.2
|
|
mako==1.0.7
|
|
markupsafe==1.1.1
|
|
more-itertools==8.2.0 # via cheroot, cherrypy, jaraco.functools
|
|
msgpack==1.0.2
|
|
portend==2.6 # via cherrypy
|
|
psutil==5.8.0
|
|
pyasn1==0.4.5
|
|
pycparser==2.19
|
|
pycryptodomex==3.9.8
|
|
pycurl==7.43.0.5
|
|
pymssql==2.1.4 ; python_version < "3.8"
|
|
pymysql==0.9.3
|
|
pyopenssl==19.0.0
|
|
python-dateutil==2.8.0
|
|
python-gnupg==0.4.4
|
|
pythonnet==2.4.0
|
|
pytz==2020.1 # via tempora
|
|
pywin32==227
|
|
pyyaml==5.3.1
|
|
pyzmq==18.0.1 ; python_version < "3.8"
|
|
requests==2.21.0
|
|
setproctitle==1.1.10
|
|
six==1.15.0 # via cheroot, cherrypy, cryptography, pyopenssl, python-dateutil, tempora
|
|
smmap==3.0.4 # via gitdb
|
|
tempora==1.14.1 # via portend
|
|
timelib==0.2.5
|
|
urllib3==1.24.3 # via requests
|
|
wheel==0.33.4
|
|
wmi==1.4.9
|
|
zc.lockfile==2.0 # via cherrypy
|