gitsafehub
github.com/davelester/incubator-aurora ↗

davelester/incubator-aurora

scanned 2026-08-15 · git d6a9958
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets1Vulnerable dependencies16Known OSS vulnerabilities43Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 1 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    src/test/python/apache/aurora/client/cli/test_supdate.py:339
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 16 found · 3 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2022-31799 Bottle before 0.12.20 mishandles errors during early request binding.
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2022-31799). Fix: Update that package to its patched version.
  • Serious CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious CVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Worth fixing CVE-2014-3137 Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before ...
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2014-3137). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-9964 redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequ ...
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2016-9964). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-28473 The package bottle from 0 and before 0.12.19 are vulnerable to Web Cac ...
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2020-28473). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-40023 python-mako: REDoS in Lexer class
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2022-40023). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41205 mako: Mako: Information disclosure via path traversal vulnerability
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2026-41205). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44307 mako: Mako: Information disclosure via directory traversal
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2026-44307). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-18874 python-psutil: Double free because of refcount mishandling
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2019-18874). Fix: Update that package to its patched version.
  • Worth fixing CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-2296 python-requests: session fixation and cookie stealing vulnerability
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2015-2296). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
    3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 43 found · 6 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2014-77 Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2014-3137). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-227 Bottle before 0.12.20 mishandles errors during early request binding.
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2022-31799). Fix: Update that package to its patched version.
  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious PYSEC-2016-32 The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/build-support/pants_requirements.txt
    A package you depend on has a known security hole (CVE-2015-8557). Fix: Update that package to its patched version.
  • Serious PYSEC-2016-32 The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/build-support/pants_requirements.txt
    A package you depend on has a known security hole (CVE-2015-8557). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-24 redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2016-9964). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-129 The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), t
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2020-28473). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-260 Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2022-40023). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2617 Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2026-44307). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-88 Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2026-41205). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2019-41 psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2019-18874). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2018-28 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to dis
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-74 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `re
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=False
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system te
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-43012 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2022-40897). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2025-49 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to versio
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2025-47273). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1918 setuptools vulnerable to Command Injection via package URL
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2024-6345). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3447 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude,
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/3rdparty/python/requirements.txt
    A package you depend on has a known security hole (CVE-2026-59890). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-89 Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Ma
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/build-support/pants_requirements.txt
    A package you depend on has a known security hole (CVE-2025-69534). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-141 In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity an
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/build-support/pants_requirements.txt
    A package you depend on has a known security hole (CVE-2021-27291). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-117 A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/build-support/pants_requirements.txt
    A package you depend on has a known security hole (CVE-2022-40896). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2019-41 psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
    /workdirs/scan-352b47c9-edab-4a9a-a133-1867de9e6f94/build-support/pants_requirements.txt
    A package you depend on has a known security hole (CVE-2019-18874). Fix: Update that package to its patched version.
… 18 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.