You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "nigzak (via GitHub)" <gi...@apache.org> on 2024/02/01 16:09:14 UTC
[I] Update superset "numexpr 2.8.4" dependency in docker image because of CVE-2023-39631 [superset]
nigzak opened a new issue, #26967:
URL: https://github.com/apache/superset/issues/26967
### Bug description
The docker inspector marks the image of superset 3.1.0 with a finding of numexpr 2.8.4
https://scout.docker.com/vulnerabilities/id/CVE-2023-39631?s=pypa&n=numexpr&t=pypi&vr==2.8.4&utm_source=desktop&utm_medium=ExternalLink
CVSS SCORE = 9.8
### How to reproduce the bug
download image 3.1.0
open in docker inspector
### Screenshots/recordings
_No response_
### Superset version
3.1.0
### Python version
3.9
### Node version
16
### Browser
Chrome
### Additional context
3.0.3 is NOT affected by this
### Checklist
- [X] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [X] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [X] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Update superset "numexpr 2.8.4" dependency in docker image of superset 3.1.0 because of CVE-2023-39631 [superset]
Posted by "nigzak (via GitHub)" <gi...@apache.org>.
nigzak commented on issue #26967:
URL: https://github.com/apache/superset/issues/26967#issuecomment-1956303472
superset 3.1.1 also affected
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Update superset "numexpr 2.8.4" dependency in docker image of superset 3.1.0/3.1.1 because of CVE-2023-39631 [superset]
Posted by "nigzak (via GitHub)" <gi...@apache.org>.
nigzak commented on issue #26967:
URL: https://github.com/apache/superset/issues/26967#issuecomment-1973913181
closing issue, pull request is merged with the update
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Update superset "numexpr 2.8.4" dependency in docker image of superset 3.1.0/3.1.1 because of CVE-2023-39631 [superset]
Posted by "nigzak (via GitHub)" <gi...@apache.org>.
nigzak closed issue #26967: Update superset "numexpr 2.8.4" dependency in docker image of superset 3.1.0/3.1.1 because of CVE-2023-39631
URL: https://github.com/apache/superset/issues/26967
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org