DO NOT MERGE: Test adding requirements.txt with known vulnerabilities

[sumau]

Test Datadog and GitHub Dependency review picks up vulnerabilities when adding requirements.txt with known vulnerabilities

[github-actions]

Dependency Review

The following issues were found:

• ❌ 6 vulnerable package(s)

See the Details below.

Vulnerabilities

requirements.txt

Name	Version	Vulnerability	Severity
django	1.5.10	Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.	critical
		SQL injection in Django	critical
		Django Potential account hijack via password reset form	critical
		Django CSRF Protection Bypass	high
		Django vulnerable to Reflected File Download attack	high
		Django Denial-of-service by filling session store	high
		Django Vulnerable to HTTP Response Splitting Attack	high
		Django is subject to SQL injection through its column aliases	high
		Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows	high
		Path Traversal in Django	moderate
		Django Cross-site scripting Vulnerability	moderate
		Django XSS Vulnerability	moderate
		Django Cross-site Scripting Vulnerability	moderate
		Django cross-site scripting (XSS) attack via user-supplied redirect URLs	moderate
		Django allows enumeration of user e-mail addresses	moderate
		Django Improper Output Neutralization for Logs vulnerability	moderate
		Django User Enumeration Vulnerability	low
aiohttp	3.7.0	AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb	high
		aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests	high
		aiohttp is vulnerable to directory traversal	high
		AIOHTTP vulnerable to DoS when bypassing asserts	moderate
		AIOHTTP vulnerable to denial of service through large payloads	moderate
		AIOHTTP vulnerable to DoS through chunked messages	moderate
		aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage	moderate
		AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows	moderate
		AIOHTTP has a Multipart Header Size Bypass	moderate
		AIOHTTP accepts duplicate Host headers	moderate
		AIOHTTP is Vulnerable to Deserialization of Untrusted Data	moderate
		AIOHTTP is vulnerable to cross-origin redirect with per-request cookies	moderate
		aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges	moderate
		aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines	moderate
		aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup	moderate
		aiohttp: HTTP/1 Pipelined Requests Queue Without Limit	moderate
		aiohttp: Incomplete websocket frame payloads bypass memory limits	moderate
		aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser	moderate
		AIOHTTP has problems in HTTP parser (the python one, not llhttp)	moderate
		aiohttp has vulnerable dependency that is vulnerable to request smuggling	moderate
		aiohttp allows request smuggling due to incorrect parsing of chunk extensions	moderate
		aiohttp Cross-site Scripting vulnerability on index pages for static file handling	moderate
		aiohttp's ClientSession is vulnerable to CRLF injection via method	moderate
		aiohttp's ClientSession is vulnerable to CRLF injection via version	moderate
		aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators	moderate
		`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)	low
		aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections	low
		aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect	low
		Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks	low
		aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence	low
		aiohttp: CRLF injection in multipart headers	low
		AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass	low
		AIOHTTP has HTTP response splitting via \r in reason phrase	low
		AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect	low
		AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS	low
		AIOHTTP has CRLF injection through multipart part content type header construction	low
		AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector	low
		AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections	low
		AIOHTTP Vulnerable to Cookie Parser Warning Storm	low
		AIOHTTP's unicode processing of header values could cause parsing discrepancies	low
		AIOHTTP has unicode match groups in regexes for ASCII protocol elements	low
		AIOHTTP vulnerable to brute-force leak of internal static file path components	low
apache-airflow	2.6.3	Apache Airflow proxy credentials for various providers might leak in task logs	high
		Apache Airflow information exposure vulnerability	high
		Apache Airflow: Bypass permission verification to read code of other dags	high
		Apache Airflow Vulnerable to Deserialization of Untrusted Data	high
		Apache Airflow: pickle deserialization vulnerability in XComs	high
		Apache Airflow denial of service vulnerability	high
		Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability	high
		Apache Airflow Session Fixation vulnerability	high
		Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor	high
		Apache Airflow: Authenticated users can bypass the `is_safe_url` check	high
		Apache Airflow vulnerable to Execution with Unnecessary Privileges	high
		Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table	high
		Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler	high
		Apache Airflow: RCE by race condition in example_xcom dag	high
		Apache Airflow error reporting may expose full kwargs	moderate
		Apache Airflow exposes sensitive information in its log files	moderate
		Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access	moderate
		Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record	moderate
		Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions	moderate
		Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra`  to read-permitted users	moderate
		Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout	moderate
		Apache Airflow has a Link Following issue	moderate
		Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor	moderate
		Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor	moderate
		Apache Airflow has an Authorization Bypass Through User-Controlled Key	moderate
		Apache Airflow has no certificate validation on SMTP STARTTLS connections	moderate
		Apache Airflow missing Certificate Validation	moderate
		Apache Airflow Incorrect Authorization vulnerability	moderate
		Apache Airflow vulnerable to sensitive information exposure	moderate
		Apache Airflow vulnerable to privilege escalation	moderate
		Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs	moderate
		Apache Airflow vulnerable to Exposure of Sensitive Information	moderate
		Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes	moderate
		Apache Airflow Improper Access Control vulnerability	moderate
		Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere	moderate
		Apache Airflow has a stored cross-site scripting vulnerability	moderate
		Apache Airflow: DAG Code and Import Error Permissions Ignored	moderate
		Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users	moderate
		Apache Airflow Potential Cross-site Scripting Vulnerability	moderate
		Apache Airflow Cross-site Scripting Vulnerability	moderate
		Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users	moderate
		Apache Airflow does not return the "Cache-Control" header for dynamic content	low
		Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data	low
flask	2.2.4	Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header	high
		Flask session does not add `Vary: Cookie` header when accessed in some ways	low
jupyterhub	4.0.1	Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing	high
		JupyterHub has a privilege escalation vulnerability with the `admin:users` scope	high
		JupyterHub has an Open Redirect Vulnerability	moderate
torch	2.7.1	PyTorch Improper Resource Shutdown or Release vulnerability	moderate
		PyTorch is vulnerable to memory corruption through its unpack_sequence function	moderate
		PyTorch is vulnerable to memory corruption through its torch.jit.script function	low
		PyTorch is vulnerable to memory corruption through its torch.lstm_cell function	low

OpenSSF Scorecard

Package	Version	Score	Details
pip/django	1.5.10	Unknown	Unknown
pip/aiohttp	3.7.0	🟢 7.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 4 Found 7/15 approved changesets -- score normalized to 4 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Signed-Releases 🟢 6 4 out of the last 5 releases have a total of 4 signed artifacts.
pip/apache-airflow	2.6.3	Unknown	Unknown
pip/flask	2.2.4	Unknown	Unknown
pip/jupyterhub	4.0.1	Unknown	Unknown
pip/torch	2.7.1	Unknown	Unknown

Scanned Files

• requirements.txt

[github-actions]

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage

[github-actions]

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage

[datadog-uktrade]

       

🛑 Gate Violations

📚 5 Library vulnerabilities detected

A No new library vulnerabilities gate may be blocking this PR.

Critical: apache-airflow 2.6.3

Component with known vulnerability

Critical: django 1.5.10

Django Potential account hijack via password reset form

High: flask 2.2.4

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

View all

ℹ️ Info

No other issues found (see more)

🛠️ No new code quality issues
🛡️ No new code vulnerabilities
🧱 No new Infrastructure as Code (IaC) issues
🔑 No new secrets detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 81c2a9a | Docs | Give us feedback!}

[datadog-uktrade]

⚫ Critical: Library Vulnerability

apache-airflow@2.6.3

Suggested change

	apache-airflow==2.6.3
	apache-airflow==3.3.0

Component with known vulnerability

_{Helpful? 👍/👎}     

[datadog-uktrade]

⚫ Critical: Library Vulnerability

django@1.5.10

View all suggested fixes

Suggested change

	django==1.5.10
	django==6.1b1

Suggested change

	django==1.5.10
	django==4.2.30

Suggested change

	django==1.5.10
	django==4.2.28

Django Potential account hijack via password reset form

_{Helpful? 👍/👎}     

[datadog-uktrade]

🔴 High: Library Vulnerability

flask@2.2.4

Suggested change

	flask==2.2.4
	flask==3.1.3

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

_{Helpful? 👍/👎}     

[datadog-uktrade]

🔴 High: Library Vulnerability

aiohttp@3.7.0

View all suggested fixes

Suggested change

	aiohttp==3.7.0
	aiohttp==4.0.0a1

Suggested change

	aiohttp==3.7.0
	aiohttp==3.14.1

aiohttp is vulnerable to directory traversal

_{Helpful? 👍/👎}     

[datadog-uktrade]

🔴 High: Library Vulnerability

torch@2.7.1

View all suggested fixes

Suggested change

	torch==2.7.1
	torch==2.13.0

Suggested change

	torch==2.7.1
	torch==2.12.1

Component with known vulnerability

_{Helpful? 👍/👎}