CVE-2023-32681

Advisory

Ecowitt2mqtt 2023.06.0 updates its dependency 'requests' to version '2.31.0' to include a security fix.
https://github.com/bachya/ecowitt2mqtt/pull/596/files

Affected package

Affected versions

Fixed versions

Vulnerability changelog

🚀 Features

- Allow the specification of multiple publishers (606)
- Add Home Assistant entity description for `gainXX_piezo` data points (573)
- Add Ecowitt HP2553 to device database (590)
- Add Home Assistant entity description for `interval` (571)
- Add Ecowitt HP2564 to device mapping (572)

🐛 Bug Fixes

- Fix bug where custom entity ID prefixes wouldn't flow through to HASS (594)
- Fix missing piezo entity category (593)
- Fix bug with parsing of default config with multiple gateways (592)
- Fix and simplify entity descriptions for piezo sensors (591)

🧰 Maintenance

- Bump pre-commit from 3.3.2 to 3.3.3 (603)
- Bump codespell from 2.2.4 to 2.2.5 (605)
- Bump blacken-docs from 1.13.0 to 1.14.0 (602)
- Bump pyupgrade from 3.4.0 to 3.6.0 (599)
- Bump dessant/lock-threads from 4.0.0 to 4.0.1 (601)
- Bump pytest from 7.3.1 to 7.3.2 (598)
- Bump fastapi from 0.96.0 to 0.97.0 (600)
- Bump ruff from 0.0.271 to 0.0.272 (597)
- Pin `requests` to fix security issue (596)
- Use Poetry 1.5.1 in Dockerfile (595)
- Bump ruff from 0.0.270 to 0.0.271 (589)
- Bump coverage from 7.2.6 to 7.2.7 (583)
- Bump poetry from 1.5.0 to 1.5.1 in /.github/workflows (581)
- Bump pytest-cov from 4.0.0 to 4.1.0 (575)
- Bump ruff from 0.0.269 to 0.0.270 (574)
- Bump rapidfuzz from 3.1.0 to 3.1.1 (588)
- Bump rapidfuzz from 3.0.0 to 3.1.0 (586)
- Bump fastapi from 0.95.2 to 0.96.0 (587)
- Bump typing-extensions from 4.6.2 to 4.6.3 (585)
- Bump ruamel-yaml from 0.17.28 to 0.17.31 (584)
- Bump ruamel-yaml from 0.17.27 to 0.17.28 (580)
- Bump typing-extensions from 4.6.1 to 4.6.2 (577)
- Bump ruamel-yaml from 0.17.26 to 0.17.27 (578)
- Bump typing-extensions from 4.6.0 to 4.6.1 (576)
- Bump coverage from 7.2.5 to 7.2.6 (566)
- Bump typing-extensions from 4.5.0 to 4.6.0 (564)
- Bump yamllint from 1.31.0 to 1.32.0 (565)
- Bump poetry from 1.4.2 to 1.5.0 in /.github/workflows (563)
- Bump ruff from 0.0.267 to 0.0.269 (562)
- Bump pre-commit from 3.3.1 to 3.3.2 (561)
- Bump fastapi from 0.95.1 to 0.95.2 (560)
- Bump pylint from 2.17.3 to 2.17.4 (558)
- Bump pyupgrade from 3.3.2 to 3.4.0 (557)
- Bump mypy from 1.2.0 to 1.3.0 (559)
- Return to an Alpine-based Docker image (556)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32681