Fixing Vulnerabilities by joseguzman1337 · Pull Request #8 · mandiant/ADFSpoof

joseguzman1337 · 2023-08-10T05:10:48Z

Please look at the commits to view each file's details and their objectives.

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-LXML-2316995

Bumps [certifi](https://github.com/certifi/python-certifi) from 2018.11.29 to 2023.7.22. - [Commits](certifi/python-certifi@2018.11.29...2023.07.22) --- updated-dependencies: - dependency-name: certifi dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

…d6982dbd997 [Snyk] Security upgrade lxml from 4.3.2 to 4.6.5

Configure WhiteSource Bolt for GitHub

Bumps [cryptography](https://github.com/pyca/cryptography) from 2.6.dev1 to 41.0.3. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/commits/41.0.3) --- updated-dependencies: - dependency-name: cryptography dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [future](https://github.com/PythonCharmers/python-future) from 0.16.0 to 0.18.3. - [Release notes](https://github.com/PythonCharmers/python-future/releases) - [Changelog](https://github.com/PythonCharmers/python-future/blob/master/docs/changelog.rst) - [Commits](PythonCharmers/python-future@v0.16.0...v0.18.3) --- updated-dependencies: - dependency-name: future dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bump certifi from 2018.11.29 to 2023.7.22

Bump future from 0.16.0 to 0.18.3

Bumps [lxml](https://github.com/lxml/lxml) from 4.3.2 to 4.9.1. - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-4.3.2...lxml-4.9.1) --- updated-dependencies: - dependency-name: lxml dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

….0.3 Bump cryptography from 2.6.dev1 to 41.0.3

Bump lxml from 4.3.2 to 4.9.1

google-cla · 2023-08-10T05:10:52Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Bumps [cryptography](https://github.com/pyca/cryptography) from 41.0.3 to 41.0.6. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@41.0.3...41.0.6) --- updated-dependencies: - dependency-name: cryptography dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

…n_1709550625 [StepSecurity] Apply security best practices

….0.6 Bump cryptography from 41.0.3 to 41.0.6

Bumps [cryptography](https://github.com/pyca/cryptography) from 41.0.6 to 42.0.4. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@41.0.6...42.0.4) --- updated-dependencies: - dependency-name: cryptography dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

…2.0.4 Bump cryptography from 41.0.6 to 42.0.4

Bumps [signxml](https://github.com/kislyuk/signxml) from 2.6.0 to 3.2.2. - [Release notes](https://github.com/kislyuk/signxml/releases) - [Changelog](https://github.com/XML-Security/signxml/blob/develop/Changes.rst) - [Commits](XML-Security/signxml@v2.6.0...v3.2.2) --- updated-dependencies: - dependency-name: signxml dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [future](https://github.com/PythonCharmers/python-future) from 0.18.3 to 1.0.0. - [Release notes](https://github.com/PythonCharmers/python-future/releases) - [Changelog](https://github.com/PythonCharmers/python-future/blob/master/docs/changelog.rst) - [Commits](PythonCharmers/python-future@v0.18.3...v1.0.0) --- updated-dependencies: - dependency-name: future dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [asn1crypto](https://github.com/wbond/asn1crypto) from 0.24.0 to 1.5.1. - [Changelog](https://github.com/wbond/asn1crypto/blob/master/changelog.md) - [Commits](wbond/asn1crypto@0.24.0...1.5.1) --- updated-dependencies: - dependency-name: asn1crypto dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bump signxml from 2.6.0 to 3.2.2

Bump future from 0.18.3 to 1.0.0

Bump asn1crypto from 0.24.0 to 1.5.1

Bumps [certifi](https://github.com/certifi/python-certifi) from 2023.7.22 to 2024.2.2. - [Commits](certifi/python-certifi@2023.07.22...2024.02.02) --- updated-dependencies: - dependency-name: certifi dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bump certifi from 2023.7.22 to 2024.2.2

Bumps [six](https://github.com/benjaminp/six) from 1.12.0 to 1.16.0. - [Changelog](https://github.com/benjaminp/six/blob/master/CHANGES) - [Commits](benjaminp/six@1.12.0...1.16.0) --- updated-dependencies: - dependency-name: six dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…hy-46.0.5 Bump cryptography from 46.0.4 to 46.0.5

…4004 Bump pyasn1 from 0.6.1 to 0.6.2 in the pip group across 1 directory

Bumps [signxml](https://github.com/XML-Security/signxml) from 4.2.1 to 4.4.0. - [Release notes](https://github.com/XML-Security/signxml/releases) - [Changelog](https://github.com/XML-Security/signxml/blob/main/Changes.rst) - [Commits](XML-Security/signxml@v4.2.1...v4.4.0) --- updated-dependencies: - dependency-name: signxml dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the pip group with 2 updates in the / directory: [pyasn1](https://github.com/pyasn1/pyasn1) and [pyopenssl](https://github.com/pyca/pyopenssl). Updates `pyasn1` from 0.6.2 to 0.6.3 - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.2...v0.6.3) Updates `pyopenssl` from 25.3.0 to 26.0.0 - [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst) - [Commits](pyca/pyopenssl@25.3.0...26.0.0) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.3 dependency-type: direct:production dependency-group: pip - dependency-name: pyopenssl dependency-version: 26.0.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

…7f4a Bump the pip group across 1 directory with 2 updates

Bump signxml from 4.2.1 to 4.4.0

Bumps [future](https://github.com/PythonCharmers/python-future) from 0.18.3 to 1.0.0. - [Release notes](https://github.com/PythonCharmers/python-future/releases) - [Changelog](https://github.com/PythonCharmers/python-future/blob/master/docs/changelog.rst) - [Commits](PythonCharmers/python-future@v0.18.3...v1.0.0) --- updated-dependencies: - dependency-name: future dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

chore(deps): bump future from 0.18.3 to 1.0.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Configure Mend Bolt for GitHub

Combines PR #118 - security patch for cryptography package. Signed-off-by: dependabot[bot] <support@github.com>

Bumps the pip group with 2 updates in the / directory: [cryptography](https://github.com/pyca/cryptography) and [lxml](https://github.com/lxml/lxml). Updates `cryptography` from 46.0.6 to 48.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.6...48.0.1) Updates `lxml` from 6.0.2 to 6.1.0 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.0.2...lxml-6.1.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 48.0.1 dependency-type: direct:production dependency-group: pip - dependency-name: lxml dependency-version: 6.1.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [signxml](https://github.com/XML-Security/signxml) from 4.4.0 to 5.1.0. - [Release notes](https://github.com/XML-Security/signxml/releases) - [Changelog](https://github.com/XML-Security/signxml/blob/main/Changes.rst) - [Commits](XML-Security/signxml@v4.4.0...v5.1.0) --- updated-dependencies: - dependency-name: signxml dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [cffi](https://github.com/python-cffi/cffi) from 2.0.0 to 2.1.0. - [Release notes](https://github.com/python-cffi/cffi/releases) - [Commits](python-cffi/cffi@v2.0.0...v2.1.0) --- updated-dependencies: - dependency-name: cffi dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com>

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.1 to 49.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.1...49.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 49.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com>

Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com>

Bumps [pyopenssl](https://github.com/pyca/pyopenssl) from 26.0.0 to 26.3.0. - [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst) - [Commits](pyca/pyopenssl@26.0.0...26.3.0) --- updated-dependencies: - dependency-name: pyopenssl dependency-version: 26.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com>

Signed-off-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com>

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.1 to 49.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.1...49.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 49.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [certifi](https://github.com/certifi/python-certifi) from 2026.2.25 to 2026.6.17. - [Commits](certifi/python-certifi@2026.02.25...2026.06.17) --- updated-dependencies: - dependency-name: certifi dependency-version: 2026.6.17 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com>

Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1. - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.1.0...lxml-6.1.1) --- updated-dependencies: - dependency-name: lxml dependency-version: 6.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com>

Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.3 to 0.6.4. - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4) --- updated-dependencies: - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

snyk-bot and others added 12 commits December 15, 2021 12:52

fix: requirements.txt to reduce vulnerabilities

dd1a80c

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-LXML-2316995

Add .whitesource configuration file

9408a30

Merge pull request #1 from 4k4xs4pH1r3/snyk-fix-5f4b09b2a58e9754b3fbf…

639c625

…d6982dbd997 [Snyk] Security upgrade lxml from 4.3.2 to 4.6.5

Merge pull request #2 from 4k4xs4pH1r3/whitesource/configure

9720f42

Configure WhiteSource Bolt for GitHub

Merge pull request #4 from 4k4xs4pH1r3/dependabot/pip/certifi-2023.7.22

318281e

Bump certifi from 2018.11.29 to 2023.7.22

Merge pull request #5 from 4k4xs4pH1r3/dependabot/pip/future-0.18.3

82687bc

Bump future from 0.16.0 to 0.18.3

Merge pull request #6 from 4k4xs4pH1r3/dependabot/pip/cryptography-41…

c82db01

….0.3 Bump cryptography from 2.6.dev1 to 41.0.3

Merge pull request #7 from 4k4xs4pH1r3/dependabot/pip/lxml-4.9.1

877cc46

Bump lxml from 4.3.2 to 4.9.1

dependabot Bot and others added 17 commits November 28, 2023 23:55

[StepSecurity] Apply security best practices

49ab830

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

Merge pull request #12 from step-security-bot/stepsecurity_remediatio…

7049943

…n_1709550625 [StepSecurity] Apply security best practices

Merge pull request #9 from 4k4xs4pH1r3/dependabot/pip/cryptography-41…

5814c84

….0.6 Bump cryptography from 41.0.3 to 41.0.6

Merge pull request #13 from 4k4xs4pH1r3/dependabot/pip/cryptography-4…

9fed023

…2.0.4 Bump cryptography from 41.0.6 to 42.0.4

Merge pull request #25 from 4k4xs4pH1r3/dependabot/pip/signxml-3.2.2

aae149e

Bump signxml from 2.6.0 to 3.2.2

Merge branch 'master' into dependabot/pip/future-1.0.0

aa18683

Merge pull request #27 from 4k4xs4pH1r3/dependabot/pip/future-1.0.0

5cd4456

Bump future from 0.18.3 to 1.0.0

Merge branch 'master' into dependabot/pip/asn1crypto-1.5.1

753938b

Merge pull request #28 from 4k4xs4pH1r3/dependabot/pip/asn1crypto-1.5.1

151df52

Bump asn1crypto from 0.24.0 to 1.5.1

Merge pull request #29 from 4k4xs4pH1r3/dependabot/pip/certifi-2024.2.2

0c7d66f

Bump certifi from 2023.7.22 to 2024.2.2

joseguzman1337 and others added 29 commits March 12, 2026 22:19

Merge branch 'master' into dependabot/pip/pip-5b9b6a4004

a561f4d

Merge pull request #109 from joseguzman1337/dependabot/pip/cryptograp…

718c98c

…hy-46.0.5 Bump cryptography from 46.0.4 to 46.0.5

Merge branch 'master' into dependabot/pip/pip-5b9b6a4004

1ac06fc

Merge pull request #102 from joseguzman1337/dependabot/pip/pip-5b9b6a…

1d48020

…4004 Bump pyasn1 from 0.6.1 to 0.6.2 in the pip group across 1 directory

Merge pull request #116 from joseguzman1337/dependabot/pip/pip-7b251b…

e1a1510

…7f4a Bump the pip group across 1 directory with 2 updates

Merge pull request #111 from joseguzman1337/dependabot/pip/signxml-4.4.0

7d57d9b

Bump signxml from 4.2.1 to 4.4.0

chore: bump all repository dependencies to latest

3481d90

chore: refresh Python dependencies

f4c4f76

[CRUSH] chore(repo): checkpoint pending changes #TASK-000

4e16656

Merge pull request #120 from joseguzman1337/dependabot/pip/future-1.0.0

845f44b

chore(deps): bump future from 0.18.3 to 1.0.0

chore: automated swarm-wide synchronization

be6c06c

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add .whitesource configuration file

2d1d7d8

Merge pull request #121 from joseguzman1337/whitesource/configure

5150c06

Configure Mend Bolt for GitHub

chore: remove whitesource config

6d6c17b

chore(deps): bump cryptography from 46.0.5 to 46.0.6 (#122)

6138aca

Combines PR #118 - security patch for cryptography package. Signed-off-by: dependabot[bot] <support@github.com>

Create SECURITY.md

bd00c80

Signed-off-by: jose guzman <32862241+joseguzman1337@users.noreply.github.com>

joseguzman1337 closed this Jul 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fixing Vulnerabilities - #8

Fixing Vulnerabilities#8
joseguzman1337 wants to merge 230 commits into
mandiant:masterfrom
joseguzman1337:master

joseguzman1337 commented Aug 10, 2023

Uh oh!

google-cla Bot commented Aug 10, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

joseguzman1337 commented Aug 10, 2023

Uh oh!

google-cla Bot commented Aug 10, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants