You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@beam.apache.org by "markustoivonen (via GitHub)" <gi...@apache.org> on 2024/07/08 13:02:44 UTC
[I] [Task]: Remediate CVE-2024-28397 [beam]
markustoivonen opened a new issue, #31799:
URL: https://github.com/apache/beam/issues/31799
### What needs to happen?
It seems that one of the python libraries Beam uses, js2py, has a vulnerability:
[CVE-2024-28397](https://nvd.nist.gov/vuln/detail/CVE-2024-28397)
[Exposure](https://github.com/search?q=repo%3Aapache%2Fbeam%20js2py&type=code) seems fairly limited (not sure if its even realistic to be exploited when using Beam).
### Issue Priority
Priority: 3 (nice-to-have improvement)
### Issue Components
- [X] Component: Python SDK
- [ ] Component: Java SDK
- [ ] Component: Go SDK
- [ ] Component: Typescript SDK
- [ ] Component: IO connector
- [X] Component: Beam YAML
- [ ] Component: Beam examples
- [ ] Component: Beam playground
- [ ] Component: Beam katas
- [ ] Component: Website
- [ ] Component: Spark Runner
- [ ] Component: Flink Runner
- [ ] Component: Samza Runner
- [ ] Component: Twister2 Runner
- [ ] Component: Hazelcast Jet Runner
- [ ] Component: Google Cloud Dataflow Runner
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "jhammarstedt (via GitHub)" <gi...@apache.org>.
jhammarstedt commented on issue #31799:
URL: https://github.com/apache/beam/issues/31799#issuecomment-2228234452
Hi, what's the status on this one? Getting high severity warning in my workflows when bumping beam to 2.57
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "derrickaw (via GitHub)" <gi...@apache.org>.
derrickaw commented on issue #31799:
URL: https://github.com/apache/beam/issues/31799#issuecomment-3516985731
not stale
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "liferoad (via GitHub)" <gi...@apache.org>.
liferoad commented on issue #31799:
URL: https://github.com/apache/beam/issues/31799#issuecomment-2228422864
@Polber PTAL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "derrickaw (via GitHub)" <gi...@apache.org>.
derrickaw commented on issue #31799:
URL: https://github.com/apache/beam/issues/31799#issuecomment-3948277294
Being tracked by #37669
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "derrickaw (via GitHub)" <gi...@apache.org>.
derrickaw commented on issue #31799:
URL: https://github.com/apache/beam/issues/31799#issuecomment-3937128053
Caused issues with post commit and requires node. Reverting PR - #37665.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "derrickaw (via GitHub)" <gi...@apache.org>.
derrickaw commented on issue #31799:
URL: https://github.com/apache/beam/issues/31799#issuecomment-2919719008
Briefly looked into it and it seems v0.74 is still the latest version. Probably should either wait until another version comes out that fixes this vulnerability or find another python library to use that doesn't have a vulnerability.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "derrickaw (via GitHub)" <gi...@apache.org>.
derrickaw closed issue #31799: [Task]: Remediate CVE-2024-28397
URL: https://github.com/apache/beam/issues/31799
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #31799:
URL: https://github.com/apache/beam/issues/31799#issuecomment-3451112518
This issue has been marked as stale due to 150 days of inactivity. It will be closed in 30 days if no further activity occurs. If you think that’s incorrect or this issue still needs to be addressed, please simply write any comment. If closed, you can reopen the issue at any time. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "derrickaw (via GitHub)" <gi...@apache.org>.
derrickaw commented on issue #31799:
URL: https://github.com/apache/beam/issues/31799#issuecomment-4613297912
fixed via https://github.com/apache/beam/pull/38473
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Remediate CVE-2024-28397 [beam]
Posted by "jrmccluskey (via GitHub)" <gi...@apache.org>.
jrmccluskey closed issue #31799: [Task]: Remediate CVE-2024-28397
URL: https://github.com/apache/beam/issues/31799
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org