New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency ipython to v8 [SECURITY] #21

Open

renovate wants to merge 1 commit into master from renovate/pypi-ipython-vulnerability

Contributor

renovate bot commented Aug 6, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ipython	`^7.11.1` -> `^8.0.0`

GitHub Vulnerability Alerts

CVE-2023-24816

IPython provides an interactive Python shell and Jupyter kernel to use Python interactively. Versions prior to 8.10.0 are vulnerable to command injection in the set_term_title function under specific conditions. This has been patched in version 8.10.0.

Impact

Users are only vulnerable when calling this function in Windows in a Python environment where ctypes is not available. The dependency on ctypes in IPython.utils._process_win32 prevents the vulnerable code from ever being reached (making it effectively dead code). However, as a library that could be used by another tool, set_term_title could introduce a vulnerability for dependencies. Currently set_term_title is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user to cd into this directory, then the attacker can execute arbitrary commands contained in the folder names.

Release Notes

ipython/ipython (ipython)

`v8.10.0`

`v8.9.0`

`v8.8.0`

`v8.7.0`

`v8.6.0`

`v8.5.0`

`v8.4.0`

`v8.3.0`

`v8.2.0`

`v8.1.1`

`v8.1.0`

`v8.0.1`

`v8.0.0`

`v7.34.0`

`v7.33.0`

`v7.32.0`

`v7.31.1`

`v7.31.0`

`v7.30.1`

`v7.30.0`

`v7.29.0`

`v7.28.0`

`v7.27.0`

`v7.26.0`

`v7.25.0`

`v7.24.1`

`v7.24.0`

`v7.23.1`

`v7.23.0`

`v7.22.0`

`v7.21.0`

`v7.20.0`

`v7.19.0`

`v7.18.1`: See https://pypi.org/project/ipython/

We do not use GitHub release anymore. Please see PyPI https://pypi.org/project/ipython/

`v7.18.0`

`v7.17.0`

Configuration

📅 Schedule: Branch creation - "" in timezone US/Eastern, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Contributor Author

renovate bot commented Aug 6, 2024 •

edited

Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

Creating virtualenv locust-tests-e8dpAx4K-py3.12 in /home/ubuntu/.cache/pypoetry/virtualenvs
Updating dependencies
Resolving dependencies...


The current project's Python requirement (>=3.6,<4.0) is not compatible with some of the required packages Python requirement:
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.8, so it will not be satisfied for Python >=3.6,<3.8
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.9, so it will not be satisfied for Python >=3.6,<3.9
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10
  - ipython requires Python >=3.10, so it will not be satisfied for Python >=3.6,<3.10

Because no versions of ipython match >8.0.0,<8.0.1 || >8.0.1,<8.1.0 || >8.1.0,<8.1.1 || >8.1.1,<8.2.0 || >8.2.0,<8.3.0 || >8.3.0,<8.4.0 || >8.4.0,<8.5.0 || >8.5.0,<8.6.0 || >8.6.0,<8.7.0 || >8.7.0,<8.8.0 || >8.8.0,<8.9.0 || >8.9.0,<8.10.0 || >8.10.0,<8.11.0 || >8.11.0,<8.12.0 || >8.12.0,<8.12.1 || >8.12.1,<8.12.2 || >8.12.2,<8.12.3 || >8.12.3,<8.13.1 || >8.13.1,<8.13.2 || >8.13.2,<8.14.0 || >8.14.0,<8.15.0 || >8.15.0,<8.16.1 || >8.16.1,<8.17.1 || >8.17.1,<8.17.2 || >8.17.2,<8.18.0 || >8.18.0,<8.18.1 || >8.18.1,<8.20.0 || >8.20.0,<8.21.0 || >8.21.0,<8.22.1 || >8.22.1,<8.22.2 || >8.22.2,<8.23.0 || >8.23.0,<8.24.0 || >8.24.0,<8.25.0 || >8.25.0,<8.26.0 || >8.26.0,<8.27.0 || >8.27.0,<9.0.0
 and ipython (8.0.0) requires Python >=3.8, ipython is forbidden.
And because ipython (8.0.1) requires Python >=3.8
 and ipython (8.1.0) requires Python >=3.8, ipython is forbidden.
And because ipython (8.1.1) requires Python >=3.8
 and ipython (8.2.0) requires Python >=3.8, ipython is forbidden.
And because ipython (8.3.0) requires Python >=3.8
 and ipython (8.4.0) requires Python >=3.8, ipython is forbidden.
And because ipython (8.5.0) requires Python >=3.8
 and ipython (8.6.0) requires Python >=3.8, ipython is forbidden.
And because ipython (8.7.0) requires Python >=3.8
 and ipython (8.8.0) requires Python >=3.8, ipython is forbidden.
And because ipython (8.9.0) requires Python >=3.8
 and ipython (8.10.0) requires Python >=3.8, ipython is forbidden.
And because ipython (8.11.0) requires Python >=3.8
 and ipython (8.12.0) requires Python >=3.8, ipython is forbidden.
And because ipython (8.12.1) requires Python >=3.8
 and ipython (8.12.2) requires Python >=3.8, ipython is forbidden.
And because ipython (8.12.3) requires Python >=3.8
 and ipython (8.13.1) requires Python >=3.9, ipython is forbidden.
And because ipython (8.13.2) requires Python >=3.9
 and ipython (8.14.0) requires Python >=3.9, ipython is forbidden.
And because ipython (8.15.0) requires Python >=3.9
 and ipython (8.16.1) requires Python >=3.9, ipython is forbidden.
And because ipython (8.17.1) requires Python >=3.9
 and ipython (8.17.2) requires Python >=3.9, ipython is forbidden.
And because ipython (8.18.0) requires Python >=3.9
 and ipython (8.18.1) requires Python >=3.9, ipython is forbidden.
And because ipython (8.20.0) requires Python >=3.10
 and ipython (8.21.0) requires Python >=3.10, ipython is forbidden.
And because ipython (8.22.1) requires Python >=3.10
 and ipython (8.22.2) requires Python >=3.10, ipython is forbidden.
And because ipython (8.23.0) requires Python >=3.10
 and ipython (8.24.0) requires Python >=3.10, ipython is forbidden.
And because ipython (8.25.0) requires Python >=3.10
 and ipython (8.26.0) requires Python >=3.10, ipython is forbidden.
So, because ipython (8.27.0) requires Python >=3.10
 and locust-tests depends on ipython (^8.0.0), version solving failed.

  • Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
    
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.8,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.9,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"
    For ipython, a possible solution would be to set the `python` property to ">=3.10,<4.0"

    https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
    https://python-poetry.org/docs/dependency-specification/#using-environment-markers

renovate bot force-pushed the renovate/pypi-ipython-vulnerability branch from 37885df to 188a62f Compare

August 26, 2024 06:45

renovate bot force-pushed the renovate/pypi-ipython-vulnerability branch from 188a62f to 58e364a Compare

September 2, 2024 09:20


          Update dependency ipython to v8 [SECURITY]

6510a0d

renovate bot force-pushed the renovate/pypi-ipython-vulnerability branch from 58e364a to 6510a0d Compare

September 16, 2024 11:35

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet