Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

resolve py3.6 CVEs #689

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

resolve py3.6 CVEs #689

wants to merge 1 commit into from

Conversation

jmeixensperger
Copy link
Contributor

Resolves the following CVEs:

CVE-2019-20916 / CVE-2021-3572       HIGH        pkg:pypi/pip@9.0.3
CVE-2024-6345 / CVE-202240897        HIGH        pkg:pypi/setuptools@39.2.0
CVE-2023-32681                       MED         pkg:pypi/requests@2.28.2

I observed that the glib2-devel depends on and installs python 3.6. This was also installing rpm packages for the pip and setuptools versions reported above. Removing the relevant rpm packages did not resolve the CVEs, and I verified that the image build worked fine without glib2-devel.

I also removed the version pin for the requests package on the base layer. It's important to note that the Splunk product may install its own version(s) of requests depending on the build, however this will not affect the version we install via pip.

@jmeixensperger jmeixensperger requested a review from a team as a code owner December 17, 2024 22:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant