There seems to be a security vulnerability related to an outdated python package

[kurtwheeler]

@cgreene received the following notice:

Project Cognoma organization
Warning!     
cognoma / core-service

Known security vulnerabilities detected
Dependency pycrypto     Version <=2.6.1     
Vulnerabilities
CVE-2018-6594 Moderate severity
    Defined in requirements.txt     

It seems like this could be as simple as updating pycrypto and redeploying.

[kurtwheeler]

Looks like the fix is to replace pycrypto with pycryptodome: pycrypto/pycrypto#253 (comment)

[kurtwheeler]

It looks like it might only be listed as dependency and not actually used:

kurt@kurtputer:~/Development/cognoma/core-service$ ggrep pycrypto
requirements.txt:32:pycrypto==2.6.1
kurt@kurtputer:~/Development/cognoma/core-service$ ggrep Crypto
requirements.txt:6:cryptography==1.5.2
requirements.txt:32:pycrypto==2.6.1

However it's hard to tell if it's actually being used by another dependency...