CVE-2017-16876

Advisory

Scml 0.5.1 pins a transitive dependency (mistune>=2.0.1) to include a fix for an XSS vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-----------------

* giving more time to testing 2020 with random
* avoiding a hashing issue in second tutorial
* rejecting crazy offers in satisficer
* ensuring that from_offers recevied tuple[tuple]
* oneshto ufun speedup
* adding ANAC 2022 running functions scml2020.utils
* import cleanup
* control sync_calls when creating oneshot worlds
* fix: requirements.txt to reduce vulnerabilities

Resources

• https://pypi.org/project/scml
• https://pyup.io/changelogs/scml/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16876