Vulnerability	Vulnerable Version
M Insecure Default Initialization of Resource nono-py is a Python bindings for nono capability-based sandboxing Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to improper enforcement of access restrictions in the `proxy` process. An attacker can gain unauthorized network access by exploiting the default configuration, which allows unrestricted outbound connections through the proxy even when restrictive policies are set. How to fix Insecure Default Initialization of Resource? Upgrade `nono-py` to version 0.11.0 or higher.	[,0.11.0)
M Access Control Bypass nono-py is a Python bindings for nono capability-based sandboxing Affected versions of this package are vulnerable to Access Control Bypass due to the policy JSON accepting unknown security-sensitive fields and the failure to automatically enforce `CapabilitySet.proxy_only` when resolving a policy-derived `ProxyConfig`. An attacker can gain unauthorized network access by crafting policies with unsupported or misspelled restrictions, potentially allowing outbound requests outside the intended proxy allowlist. How to fix Access Control Bypass? Upgrade `nono-py` to version 0.10.1 or higher.	[,0.10.1)

Insecure Default Initialization of Resource

nono-py is a Python bindings for nono capability-based sandboxing

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to improper enforcement of access restrictions in the proxy process. An attacker can gain unauthorized network access by exploiting the default configuration, which allows unrestricted outbound connections through the proxy even when restrictive policies are set.

How to fix Insecure Default Initialization of Resource?

Upgrade nono-py to version 0.11.0 or higher.

[,0.11.0)

Access Control Bypass

nono-py is a Python bindings for nono capability-based sandboxing

Affected versions of this package are vulnerable to Access Control Bypass due to the policy JSON accepting unknown security-sensitive fields and the failure to automatically enforce CapabilitySet.proxy_only when resolving a policy-derived ProxyConfig. An attacker can gain unauthorized network access by crafting policies with unsupported or misspelled restrictions, potentially allowing outbound requests outside the intended proxy allowlist.

How to fix Access Control Bypass?

Upgrade nono-py to version 0.10.1 or higher.

[,0.10.1)

Go back to all versions of this package