CVE-2020-36242

Advisory

Candig-server 1.4.0 drops its dependency 'cryptography==2.8' to avoid security issues.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This is the v1.4.0 release of the candig-server.

This release introduces:

- Database Snapshot Report: A new functionality that creates reports either in HTML or Markup containing information about Clinical; Pipeline; Genomic; Dataset; and Id of Patients stored in the database.

For more information about Database Snapshot Report. please check the [documentation](https://candig-server.readthedocs.io/en/v1.4.0/datarepo.htmlcandig-snapshot).

Improvements:
- Some improvements on the documentation
- Upgrade of some third-party libraries, improving security

Component | Changes were made | Backward compatibility
------------ | ------------- | -------------
API | No | N/A
Server Side Configs | No | N/A

Resources

• https://pypi.org/project/candig-server
• https://pyup.io/changelogs/candig-server/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36242