CVE-2022-4304

Advisory

Pycape 3.0.0 updates its dependency 'cryptography' to v39.0.1 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Breaking Changes
Function tokens have been removed from latest versions of Cape SDKs; the new authentication method is to use [personal access tokens](https://docs.capeprivacy.com/reference/user-tokens). Technically this introduces a feature regression, since PATs give access to a user's entire set of deployed functions. A future update will allow PATs to be scoped to only authenticate run requests for specific functions, which will bring back parity with the function token approach.

What's Changed

* bump cryptography to resolve security alert (117) jvmncs
* bump dependencies, resolving some dependabot warnings (116) jvmncs
* fix docsite logo and missing cape_encrypt api ref (114) jvmncs
* refactor pycape api to use PATs, not fn tokens (113) jvmncs
* small fix to Cape.key response handler (112) jvmncs

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4304