| Description | For many weeks now, Github Security alert digest has been reminding me that there is a security fail in pipfile.lock in my clone of the bareos repo:
Known security vulnerabilities detected
Dependency GitPython Version <= 3.1.29 Upgrade to ~> 3.1.30
Defined in Pipfile.lock
Vulnerabilities
CVE-2022-24439 High severity
The stanza in pipfile reads:
"gitpython": {
"hashes": [
"sha256:3283ae2fba31c913d857e12e5ba5f9a7772bbc064ae2bb09efafa71b0dd4939b",
"sha256:be27633e7509e58391f10207cd32b2a6cf5b908f92d9cd30da2e514e1137af61"
],
"index": "pypi",
"version": "==3.1.14"
},
I would suggest this is updated to 3.1.30 or later (even if at present this specific CVE can't be accessed because that might change!) |
|---|
