—

PYSEC-2015-33

Quick fix

PYSEC-2015-33 — rhodecode: upgrade to the fixed version with the command below.

pip install --upgrade 'rhodecode>=2.2.7'

Details

RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) get_locks, or (3) get_user_groups API method.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/rhodecode

Introduced in: 0Fixed in: 2.2.7

Fixpip install --upgrade 'rhodecode>=2.2.7'

References

https://rhodecode.com/blog/rhodecode-enterprise-security-release/[ARTICLE]