You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@superset.apache.org by Boris Modylevsky <bo...@gmail.com> on 2024/10/13 11:20:34 UTC
Looking for dev to lead security release
Hello team,
I am new here, so please be kind.
The current 4.0.2 version contains several security vulnerabilities, which
basically prevents us from using SuperSet at corporate level.
I would appreciate if somebody can lead a security release by cherry
picking relevant commits from 4.1.0rc2.
Thanks in advance
Boris
Re: Looking for dev to lead security release
Posted by Hans Christian Ravache Lemm <hc...@gmail.com>.
If you run a Trivy Scan on the Docker image, it will show up 82 HIGH + 3
CRITICAL vulnerabilities for Debian and 6 HIGH + 1 CRITICAL for Python.
On Sun, 13 Oct 2024 at 13:28, Pankaj soni <pa...@gmail.com> wrote:
> Be specific please. What security vulnerabilities you have come across?
>
> On Sun, 13 Oct, 2024, 16:50 Boris Modylevsky, <bo...@gmail.com> wrote:
>
> > Hello team,
> >
> > I am new here, so please be kind.
> >
> > The current 4.0.2 version contains several security vulnerabilities,
> which
> > basically prevents us from using SuperSet at corporate level.
> >
> > I would appreciate if somebody can lead a security release by cherry
> > picking relevant commits from 4.1.0rc2.
> >
> > Thanks in advance
> > Boris
> >
>
--
Hans C. Ravache Lemm
Re: Looking for dev to lead security release
Posted by Boris Modylevsky <bo...@gmail.com>.
Here are the vulnerabilities found by Snyk scanning.
Cryptography 42.0.8 to 43.0.1
Gunicorn 21.2.0 to 22.0.0
Holidays 0.25 to 0.45
Selenium 4.9.1 to 4.15.1
Setuptools 65.5.1 to 70.0.0
Sqlparse 0.4.4 to 0.5.0
On Mon, Oct 14, 2024, 11:05 Boris Modylevsky <bo...@gmail.com> wrote:
> Here are the vulnerabilities found by Snyk scanning.
>
>
> Cryptography 42.0.8 to 43.0.1
> Gunicorn 21.2.0 to 22.0.0
> Holidays 0.25 to 0.45
> Selenium 4.9.1 to 4.15.1
> Setuptools 65.5.1 to 70.0.0
> Sqlparse 0.4.4 to 0.5.0
>
>
>
>
>
>
> On Sun, Oct 13, 2024, 14:28 Pankaj soni <pa...@gmail.com> wrote:
>
>> Be specific please. What security vulnerabilities you have come across?
>>
>> On Sun, 13 Oct, 2024, 16:50 Boris Modylevsky, <bo...@gmail.com> wrote:
>>
>> > Hello team,
>> >
>> > I am new here, so please be kind.
>> >
>> > The current 4.0.2 version contains several security vulnerabilities,
>> which
>> > basically prevents us from using SuperSet at corporate level.
>> >
>> > I would appreciate if somebody can lead a security release by cherry
>> > picking relevant commits from 4.1.0rc2.
>> >
>> > Thanks in advance
>> > Boris
>> >
>>
>
Re: Looking for dev to lead security release
Posted by Pankaj soni <pa...@gmail.com>.
Be specific please. What security vulnerabilities you have come across?
On Sun, 13 Oct, 2024, 16:50 Boris Modylevsky, <bo...@gmail.com> wrote:
> Hello team,
>
> I am new here, so please be kind.
>
> The current 4.0.2 version contains several security vulnerabilities, which
> basically prevents us from using SuperSet at corporate level.
>
> I would appreciate if somebody can lead a security release by cherry
> picking relevant commits from 4.1.0rc2.
>
> Thanks in advance
> Boris
>