Skip to content

Commit 7baeb1d

Browse files
oliver-zehentleitneroliver-zehentleitner
committed
2.7.1 RC2
1 parent fedd776 commit 7baeb1d

23 files changed

+306
-39
lines changed

‎CHANGELOG.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,62 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
2020
### Fixed
2121
- Import in `licensing_manager.py`.
2222
- Type of global `logger` and `connect` variable.
23+
### Security
24+
- Set higher minimum version `2.31.0` for `requests`, as vulnerabilities were found in earlier versions:
25+
- CVE-2023-32681, Score: 6.1 (Medium)
26+
- Requests is a HTTP library. Requests has been leaking Proxy-Authorization headers to destination servers when
27+
redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the
28+
`Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify
29+
the header in the request itself and remove it prior to forwarding to the destination server. However when sent
30+
over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility
31+
into the tunneled request. This results in Requests forwarding proxy credentials to the destination server
32+
unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue affects
33+
versions 2.3.0 through 2.30.0.
34+
- https://devhub.checkmarx.com/cve-details/CVE-2023-32681/
35+
- Set higher minimum version `2.5.1` for `unicorn-binance-rest-api` are affected by vulnerabilities in used dependencies!
36+
- Dependency `certifi`:
37+
- CVE-2023-37920, Score: 9.8 (High)
38+
- Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while
39+
verifying the identity of TLS hosts. Certifi 1.0.1 through 2023.5.7 recognizes "e-Tugra" root certificates.
40+
e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their
41+
systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
42+
- https://devhub.checkmarx.com/cve-details/CVE-2023-37920/
43+
- Dependency `cryptography`:
44+
- CVE-2023-38325, Score: 7.5 (High)
45+
- The cryptography package versions prior to 41.0.2 for Python mishandles SSH certificates that have critical
46+
options.
47+
- https://devhub.checkmarx.com/cve-details/CVE-2023-38325/
48+
- CVE-2023-49083, Score: 7.5 (High)
49+
- Cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling
50+
`load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and
51+
segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application
52+
attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system
53+
availability and stability. This issue affects versions 3.1 through 41.0.5.
54+
- https://devhub.checkmarx.com/cve-details/CVE-2023-49083/
55+
- CVE-2023-50782, Score: 7.5 (High)
56+
- A flaw was found in the python cryptography package versions prior to 42.0.0. This issue may allow a remote
57+
attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of
58+
confidential or sensitive data. This issue is an incomplete fix of CVE-2020-25659.
59+
- https://devhub.checkmarx.com/cve-details/CVE-2023-50782/
60+
- CVE-2024-26130, Score: 7.5 (High)
61+
- cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting
62+
in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a
63+
certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash`
64+
set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur,
65+
crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError`
66+
is properly raised.
67+
- https://devhub.checkmarx.com/cve-details/CVE-2024-26130/
68+
- Dependency `requests`:
69+
- CVE-2023-32681, Score: 6.1 (Medium)
70+
- Requests is a HTTP library. Requests has been leaking Proxy-Authorization headers to destination servers when
71+
redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the
72+
`Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify
73+
the header in the request itself and remove it prior to forwarding to the destination server. However when sent
74+
over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility
75+
into the tunneled request. This results in Requests forwarding proxy credentials to the destination server
76+
unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue affects
77+
versions 2.3.0 through 2.30.0.
78+
- https://devhub.checkmarx.com/cve-details/CVE-2023-32681/
2379

2480
## 2.7.0
2581
### Added

‎dev/sphinx/source/changelog.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,62 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
2020
### Fixed
2121
- Import in `licensing_manager.py`.
2222
- Type of global `logger` and `connect` variable.
23+
### Security
24+
- Set higher minimum version `2.31.0` for `requests`, as vulnerabilities were found in earlier versions:
25+
- CVE-2023-32681, Score: 6.1 (Medium)
26+
- Requests is a HTTP library. Requests has been leaking Proxy-Authorization headers to destination servers when
27+
redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the
28+
`Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify
29+
the header in the request itself and remove it prior to forwarding to the destination server. However when sent
30+
over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility
31+
into the tunneled request. This results in Requests forwarding proxy credentials to the destination server
32+
unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue affects
33+
versions 2.3.0 through 2.30.0.
34+
- https://devhub.checkmarx.com/cve-details/CVE-2023-32681/
35+
- Set higher minimum version `2.5.1` for `unicorn-binance-rest-api` are affected by vulnerabilities in used dependencies!
36+
- Dependency `certifi`:
37+
- CVE-2023-37920, Score: 9.8 (High)
38+
- Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while
39+
verifying the identity of TLS hosts. Certifi 1.0.1 through 2023.5.7 recognizes "e-Tugra" root certificates.
40+
e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their
41+
systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
42+
- https://devhub.checkmarx.com/cve-details/CVE-2023-37920/
43+
- Dependency `cryptography`:
44+
- CVE-2023-38325, Score: 7.5 (High)
45+
- The cryptography package versions prior to 41.0.2 for Python mishandles SSH certificates that have critical
46+
options.
47+
- https://devhub.checkmarx.com/cve-details/CVE-2023-38325/
48+
- CVE-2023-49083, Score: 7.5 (High)
49+
- Cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling
50+
`load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and
51+
segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application
52+
attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system
53+
availability and stability. This issue affects versions 3.1 through 41.0.5.
54+
- https://devhub.checkmarx.com/cve-details/CVE-2023-49083/
55+
- CVE-2023-50782, Score: 7.5 (High)
56+
- A flaw was found in the python cryptography package versions prior to 42.0.0. This issue may allow a remote
57+
attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of
58+
confidential or sensitive data. This issue is an incomplete fix of CVE-2020-25659.
59+
- https://devhub.checkmarx.com/cve-details/CVE-2023-50782/
60+
- CVE-2024-26130, Score: 7.5 (High)
61+
- cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting
62+
in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a
63+
certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash`
64+
set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur,
65+
crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError`
66+
is properly raised.
67+
- https://devhub.checkmarx.com/cve-details/CVE-2024-26130/
68+
- Dependency `requests`:
69+
- CVE-2023-32681, Score: 6.1 (Medium)
70+
- Requests is a HTTP library. Requests has been leaking Proxy-Authorization headers to destination servers when
71+
redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the
72+
`Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify
73+
the header in the request itself and remove it prior to forwarding to the destination server. However when sent
74+
over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility
75+
into the tunneled request. This results in Requests forwarding proxy credentials to the destination server
76+
unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue affects
77+
versions 2.3.0 through 2.30.0.
78+
- https://devhub.checkmarx.com/cve-details/CVE-2023-32681/
2379

2480
## 2.7.0
2581
### Added

‎docs/_modules/index.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ <h3>Navigation</h3>
254254
<a href="https://docs.lucit.tech">Index of all LUCIT Software Documentation</a><br />
255255
&copy; <a href="/license.html">Copyright</a> 2023-2023, LUCIT Systems and Development. All Rights Reserved..
256256
See <a href="/license.html">License</a> for more information.<br />
257-
Last updated on May 14 2024 at 21:10 (CET).
257+
Last updated on May 14 2024 at 21:34 (CET).
258258
<a href="https://github.com/LUCIT-Systems-and-Development/unicorn-binance-websocket-api/issues/new/choose">Found a bug</a>?
259259
<br />
260260
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.2.6.

‎docs/_modules/unicorn_binance_websocket_api/manager.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ <h1>Source code for unicorn_binance_websocket_api.manager</h1><div class="highli
208208

209209

210210
<span class="n">__app_name__</span><span class="p">:</span> <span class="nb">str</span> <span class="o">=</span> <span class="s2">&quot;unicorn-binance-websocket-api&quot;</span>
211-
<span class="n">__version__</span><span class="p">:</span> <span class="nb">str</span> <span class="o">=</span> <span class="s2">&quot;2.7.1&quot;</span>
211+
<span class="n">__version__</span><span class="p">:</span> <span class="nb">str</span> <span class="o">=</span> <span class="s2">&quot;2.7.1.dev&quot;</span>
212212
<span class="n">__logger__</span><span class="p">:</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="s2">&quot;unicorn_binance_websocket_api&quot;</span><span class="p">)</span>
213213

214214
<span class="n">logger</span> <span class="o">=</span> <span class="n">__logger__</span>
@@ -5428,7 +5428,7 @@ <h3>Navigation</h3>
54285428
<a href="https://docs.lucit.tech">Index of all LUCIT Software Documentation</a><br />
54295429
&copy; <a href="/license.html">Copyright</a> 2023-2023, LUCIT Systems and Development. All Rights Reserved..
54305430
See <a href="/license.html">License</a> for more information.<br />
5431-
Last updated on May 14 2024 at 21:10 (CET).
5431+
Last updated on May 14 2024 at 21:34 (CET).
54325432
<a href="https://github.com/LUCIT-Systems-and-Development/unicorn-binance-websocket-api/issues/new/choose">Found a bug</a>?
54335433
<br />
54345434
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.2.6.

‎docs/_sources/changelog.md.txt

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,62 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
2020
### Fixed
2121
- Import in `licensing_manager.py`.
2222
- Type of global `logger` and `connect` variable.
23+
### Security
24+
- Set higher minimum version `2.31.0` for `requests`, as vulnerabilities were found in earlier versions:
25+
- CVE-2023-32681, Score: 6.1 (Medium)
26+
- Requests is a HTTP library. Requests has been leaking Proxy-Authorization headers to destination servers when
27+
redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the
28+
`Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify
29+
the header in the request itself and remove it prior to forwarding to the destination server. However when sent
30+
over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility
31+
into the tunneled request. This results in Requests forwarding proxy credentials to the destination server
32+
unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue affects
33+
versions 2.3.0 through 2.30.0.
34+
- https://devhub.checkmarx.com/cve-details/CVE-2023-32681/
35+
- Set higher minimum version `2.5.1` for `unicorn-binance-rest-api` are affected by vulnerabilities in used dependencies!
36+
- Dependency `certifi`:
37+
- CVE-2023-37920, Score: 9.8 (High)
38+
- Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while
39+
verifying the identity of TLS hosts. Certifi 1.0.1 through 2023.5.7 recognizes "e-Tugra" root certificates.
40+
e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their
41+
systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.
42+
- https://devhub.checkmarx.com/cve-details/CVE-2023-37920/
43+
- Dependency `cryptography`:
44+
- CVE-2023-38325, Score: 7.5 (High)
45+
- The cryptography package versions prior to 41.0.2 for Python mishandles SSH certificates that have critical
46+
options.
47+
- https://devhub.checkmarx.com/cve-details/CVE-2023-38325/
48+
- CVE-2023-49083, Score: 7.5 (High)
49+
- Cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling
50+
`load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and
51+
segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application
52+
attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system
53+
availability and stability. This issue affects versions 3.1 through 41.0.5.
54+
- https://devhub.checkmarx.com/cve-details/CVE-2023-49083/
55+
- CVE-2023-50782, Score: 7.5 (High)
56+
- A flaw was found in the python cryptography package versions prior to 42.0.0. This issue may allow a remote
57+
attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of
58+
confidential or sensitive data. This issue is an incomplete fix of CVE-2020-25659.
59+
- https://devhub.checkmarx.com/cve-details/CVE-2023-50782/
60+
- CVE-2024-26130, Score: 7.5 (High)
61+
- cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting
62+
in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a
63+
certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash`
64+
set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur,
65+
crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError`
66+
is properly raised.
67+
- https://devhub.checkmarx.com/cve-details/CVE-2024-26130/
68+
- Dependency `requests`:
69+
- CVE-2023-32681, Score: 6.1 (Medium)
70+
- Requests is a HTTP library. Requests has been leaking Proxy-Authorization headers to destination servers when
71+
redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the
72+
`Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify
73+
the header in the request itself and remove it prior to forwarding to the destination server. However when sent
74+
over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility
75+
into the tunneled request. This results in Requests forwarding proxy credentials to the destination server
76+
unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue affects
77+
versions 2.3.0 through 2.30.0.
78+
- https://devhub.checkmarx.com/cve-details/CVE-2023-32681/
2379

2480
## 2.7.0
2581
### Added

0 commit comments

Comments
 (0)