Homepage

geolens@0.0.0

Auto-generated Python SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers.

  • latest version

    1.21.0

  • latest non vulnerable version

    1.21.0

  • first published

    5 months ago

  • latest version published

    3 days ago

  • licenses detected

  • View geolens package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the geolens package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Missing Authorization

    geolens is an Auto-generated Python SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers.

    Affected versions of this package are vulnerable to Missing Authorization inadequate authorization checks on cross-dataset references in multiple API endpoints. An attacker can access sensitive metadata, schema details, sample values, table rows, and raster/vector tile data from private datasets by crafting requests that exploit relationships, map layers, VRT mosaics, or AI metadata endpoints. This exposure can occur anonymously or with minimal privileges, allowing unauthorized data retrieval through manipulation of request parameters and endpoint paths.

    How to fix Missing Authorization?

    Upgrade geolens to version 1.2.3 or higher.

    [,1.2.3)
    • H
    Use of Cache Containing Sensitive Information

    geolens is an Auto-generated Python SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers.

    Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information inadequate authorization checks and improper cache control in multiple endpoints. An attacker can access sensitive data and metadata, including private record contact details, keywords, and distributions, as well as private raster and vector tiles, by sending crafted requests to endpoints that fail to properly enforce access controls or cache private data with public headers. Additional risks include enumeration of non-public dataset titles, server-side request forgery via DNS rebinding in service URL validation, token leakage and header injection through unsanitized environment variables, denial of service by submitting oversized GeoJSON geometries, and exposure of API keys in access logs. This is only exploitable if the deployment does not explicitly set production environment variables or relies on default credentials.

    How to fix Use of Cache Containing Sensitive Information?

    Upgrade geolens to version 1.2.4 or higher.

    [,1.2.4)
    Go back to all versions of this package