Skip to content

resolve py3.6 CVEs #689

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 18, 2024
Merged

resolve py3.6 CVEs #689

merged 1 commit into from
Dec 18, 2024

Conversation

jmeixensperger
Copy link
Contributor

Resolves the following CVEs:

CVE-2019-20916 / CVE-2021-3572       HIGH        pkg:pypi/pip@9.0.3
CVE-2024-6345 / CVE-202240897        HIGH        pkg:pypi/setuptools@39.2.0
CVE-2023-32681                       MED         pkg:pypi/requests@2.28.2

I observed that the glib2-devel depends on and installs python 3.6. This was also installing rpm packages for the pip and setuptools versions reported above. Removing the relevant rpm packages did not resolve the CVEs, and I verified that the image build worked fine without glib2-devel.

I also removed the version pin for the requests package on the base layer. It's important to note that the Splunk product may install its own version(s) of requests depending on the build, however this will not affect the version we install via pip.

@jmeixensperger jmeixensperger requested a review from a team as a code owner December 17, 2024 22:32
@jmeixensperger jmeixensperger merged commit 316187a into develop Dec 18, 2024
@jmeixensperger jmeixensperger deleted the py-3.6-vulns branch December 18, 2024 20:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants