CVE-2020-6802

Advisory

Quilt 3.1.13 updates its dependency 'bleach' to v3.1.4 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Python API
* Official support for Windows
* Add support for Python 3.7, 3.8
* Fix Package import in Python
* Updated libraries for stability and security
* Quiet TQDM for log files ($ export QUILT_MINIMIZE_STDOUT=true )
* CLI setting of config parameters

Catalog
* new feature to filter large S3 directories with regex
* more reliable bucket region inference
* Support preview of larger Jupyter notebooks in S3 (via transparent GZIP)
* JS (catalog) dependencies for stability and security
* extended Parquet file support (for files without a .parquet extension)
* Improvements to catalog signing logic for external and in-stack buckets

Special thanks to NathanDeMaria (CLI and Windows support) and JacksonMaxfield for contributing code to this release.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6802