CVE-2024-26130

Advisory

Fflogsapi version 2.1.0 upgrades its cryptography library to version 42.0.5 from 39.0.1 to address the security issue CVE-2024-26130.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* Added support for the new phase data exposed by the API. See
[the official v2 API docs](https://www.fflogs.com/v2-api-docs/ff/encounterphases.doc.html)
for more information
* Phase information is exposed at the fight level in this client (`FFLogsFight.phases`),
*not* at the report level
* Fix quotes not being properly escaped in query filters
* System temporary directories are now used for query caches
* As a result, the `cache_directory` param on the client is now deprecated
* Bump cryptography dependency (vulnerability fix)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26130
• https://github.com/halworsen/fflogsapi/commit/97982aee07b6a2c9a6045704fe0eefd2e59270a5