Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependencies severely out of date (and vulnerable: CVEs) #121

Closed
puckipedia opened this issue Oct 26, 2019 · 1 comment
Closed

Dependencies severely out of date (and vulnerable: CVEs) #121

puckipedia opened this issue Oct 26, 2019 · 1 comment

Comments

@puckipedia
Copy link

Steps to reproduce:

  1. Try to install bunq_sdk with only the newest versions of the dependencies installed. (e.g. via the operating system's package manager)

What should happen:

  1. bunq_sdk installs and is secure.

What happens:

  1. Could not find a version that satisfies the requirement urllib3==1.21.1, among other issues

SDK version and environment

  • Tested on 0.10.16 (y'all's issue template is wrong too)

Extra info:

in pycryptodome(x): CVE-2018-15560 (an AES crypto vuln) and so on have been fixed last year; but the dependencies are hard-coded to those of two years ago, meaning that any installation of the bunq python SDK is vulnerable.

@angelomelonas
Copy link
Contributor

All dependencies were upgraded to latest in this pull request: #128

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants