You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "sujeeth62 (via GitHub)" <gi...@apache.org> on 2024/11/13 08:32:13 UTC
[I] Vulnerabilities identified on Docker Images [superset]
sujeeth62 opened a new issue, #30908:
URL: https://github.com/apache/superset/issues/30908
### Bug description
Various vulnerabilities are reported post X-Ray scan for both OS & python for version 4.0.2
Do we have any JIRA to track these ones ?
CVE ID | Type | Severity | Packages | Source Package | Package Version | CVSS | Fix Status
CVE-2023-50387 | OS | high | libudev1,libsystemd0 | systemd | 252.17-1~deb12u1 | 7.5 | fixed in 252.23-1~deb12u1
CVE-2024-0985 | OS | high | libpq5,libpgtypes3,libecpg6,libecpg-compat3,libpq-dev,libecpg-dev | postgresql-15 | 15.5-0+deb12u1 | 8 | fixed in 15.6-0+deb12u1
CVE-2023-6246 | OS | high | libc6-dev,libc6,libc-bin,libc-dev-bin | glibc | 2.36-9+deb12u3 | 7.8 | fixed in 2.36-9+deb12u4
CVE-2023-6779 | OS | high | libc6-dev,libc6,libc-bin,libc-dev-bin | glibc | 2.36-9+deb12u3 | 7.5 | fixed in 2.36-9+deb12u4
CVE-2024-37370 | OS | high | libk5crypto3,libkrb5support0,libgssapi-krb5-2,libkrb5-3 | krb5 | 1.20.1-2+deb12u1 | 7.5 | fixed in 1.20.1-2+deb12u2
CVE-2024-45490 | OS | high | libexpat1 | expat | 2.5.0-1 | 7.5 | open
CVE-2024-0553 | OS | high | libgnutls30 | gnutls28 | 3.7.9-2 | 7.5 | fixed in 3.7.9-2+deb12u2
CVE-2024-0567 | OS | high | libgnutls30 | gnutls28 | 3.7.9-2 | 7.5 | fixed in 3.7.9-2+deb12u2
CVE-2023-44271 | python | high | pillow | | 9.5.0 | 7.5 | fixed in 10.0.0
CVE-2023-4863 | python | high | pillow | | 9.5.0 | 8.8 | fixed in 10.0.1
CVE-2023-50447 | python | high | pillow | | 9.5.0 | 8.1 | fixed in 10.2.0
GHSA-56pw-mpj4-fxww | python | high | pillow | | 9.5.0 | 7 | fixed in 10.0.1
CVE-2023-46136 | python | high | werkzeug | | 2.3.3 | 7.5 | fixed in 3.0.1, 2.3.8
CVE-2024-34069 | python | high | werkzeug | | 2.3.3 | 7.5 | fixed in 3.0.3
PRISMA-2022-0168 | python | high | pip | | 23.0.1 | 7.8 | open
CVE-2024-1135 | python | high | gunicorn | | 21.2.0 | 8.2 | fixed in 22.0.0
CVE-2024-6221 | python | high | flask-cors | | 3.0.10 | 7.5 | fixed in 4.0.2
CVE-2024-4340 | python | high | sqlparse | | 0.4.4 | 7.5 | fixed in 0.5.0
CVE-2023-43804 | python | high | urllib3 | | 1.26.6 | 8.1 | fixed in 2.0.6, 1.26.17
CVE-2024-6345 | python | high | setuptools | | 65.5.1 | 8.8 | fixed in 70.0.0
CVE-2023-50782 | python | high | cryptography | | 41.0.2 | 7.5 | fixed in 42.0.0
CVE-2023-49083 | python | high | cryptography | | 41.0.2 | 7.5 | fixed in 41.0.6
CVE-2024-26130 | python | high | cryptography | | 41.0.2 | 7.5 | fixed in 42.0.4
CVE-2024-37371 | OS | critical | libk5crypto3,libkrb5support0,libgssapi-krb5-2,libkrb5-3 | krb5 | 1.20.1-2+deb12u1 | 9.1 | fixed in 1.20.1-2+deb12u2
CVE-2023-39631 | python | critical | numexpr | | 2.8.4 | 9.8 | fixed in 2.8.5
CVE-2024-25128 | python | critical | flask-appbuilder | | 4.3.10 | 9.1 | fixed in 4.3.11
### Screenshots/recordings
_No response_
### Superset version
4.0.2
### Python version
3.10
### Node version
18 or greater
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [X] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [X] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [X] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Vulnerabilities identified on Docker Images [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #30908: Vulnerabilities identified on Docker Images
URL: https://github.com/apache/superset/issues/30908
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Vulnerabilities identified on Docker Images [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on issue #30908:
URL: https://github.com/apache/superset/issues/30908#issuecomment-2479714594
Keep in mind that the real official ASF-approved releases in theory are the tarballs on SVN, and it's people's responsibility to install that package on the right OS. In practice, for convenience, many use our docker containers and/or altered Dockerfile from this repo in some capacity and are responsible for whatever layers they put under or above that (os, orchestrator, proxies, ...). Docker images are not official releases and treated on a best-effort basis.
Clearly this community wants secure docker images, but we could use some help around running a tight ship on the docker/docker-compose/helm layers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Vulnerabilities identified on Docker Images [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #30908:
URL: https://github.com/apache/superset/issues/30908#issuecomment-2477211608
We don't use JIRA... these GitHub Issues are as close as we get... and Dependabot helps too. That said, these will likely take as much work to track as they do to _fix_, so we typically don't do it. @dpgaspar or @mistercrunch may have differing opinions here.
I'll close this since 4.0.2 is no longer the current release (4.1 just landed). Fee free to scan 4.1 using the tool(s) of your preference and open any package bump PRs to resolve these issues. It's always appreciated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Vulnerabilities identified on Docker Images [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on issue #30908:
URL: https://github.com/apache/superset/issues/30908#issuecomment-2479706919
For OS-level it should be a matter of bumping the base image. For python I can ask @sadpandajoe if the window is open to get supersetbot to ugprade python package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Vulnerabilities identified on Docker Images [superset]
Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on issue #30908:
URL: https://github.com/apache/superset/issues/30908#issuecomment-2479718690
> For OS-level it should be a matter of bumping the base image for docker. For python I can ask @sadpandajoe if the window is open to get supersetbot to ugprade python package
@mistercrunch feel free to turn them on. I think we talked that as long as they aren't breaking changes due to the bumps, we would just review them.
cc: @rusackas for confirmation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org