CVE-2022-4304

Advisory

Fastapi-login 1.9.0 updates its dependency 'cryptography' to v39.0.2 to include security fixes. Note that this is now an optional dependency.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- User callback is now run asynchronous without blocking the worker thread [92](https://github.com/MushroomMaula/fastapi_login/pull/97)
- ``custom_exception`` argument has now correct type [97](https://github.com/MushroomMaula/fastapi_login/pull/97)
- Fixed some minor security issues by updating packages
- Now includes ``LoginManager.optional`` which will return `None` instead of raising an exception.
An [example](https://fastapi-login.readthedocs.io/usage/#returning-none-instead-of-raising-an-exception) has been added to the documentation.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4304