sendgrid-python icon indicating copy to clipboard operation
sendgrid-python copied to clipboard

fix: Vulnerability fix for starkbank-ecdsa 2.2.0 dependency

Open ranjanprasad1996 opened this issue 1 year ago • 0 comments

Fixes

As part of the quay.io vulnerability report, it is reported that the sendgrid-python==6.11.0 package has a vulnerability (GHSA-9wx7-jrvc-28mm) reported for dependency starkbank-ecdsa==2.2.0 which is the latest version available from 2022 (The starbank repository no longer seems to be maintained).

This PR solves replaces the outdated starbank-ecdsa library (https://github.com/starkbank/ecdsa-python) with an actively mainained library ecdsa (https://github.com/tlsfuzzer/python-ecdsa).

Checklist

  • [x] I acknowledge that all my contributions will be made under the project's license
  • [X] I have made a material change to the repo (functionality, testing, spelling, grammar)
  • [X] I have read the Contribution Guidelines and my PR follows them
  • [X] I have titled the PR appropriately
  • [X] I have updated my branch with the main branch
  • [X] I have added tests that prove my fix is effective or that my feature works
  • [X] I have added the necessary documentation about the functionality in the appropriate .md file
  • [X] I have added inline documentation to the code I modified

ranjanprasad1996 avatar Aug 22 '24 10:08 ranjanprasad1996