-
-
Notifications
You must be signed in to change notification settings - Fork 747
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update requests to fix CVEs (security) #6062
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks!
Left a few first pointers. The main indicator is 🟢 tests, where some more work will be needed to get them all happy for both py3.6 and 3.8+.
Fixes: * CVE-2023-40267 * CVE-2023-41040 * CVE-2023-40590 * CVE-2022-24439 * XRAY-198950
Fixes: * CVE-2023-32681
Fixes: * XRAY-195083
Fixes: * CVE-2023-4807 * CVE-2023-2650 * CVE-2023-3446 For StackStorm on Python 3.8 only
This reverts commit b1aa079357c2e8a7b0f9a30f4fb5f03ac7abec2f.
This reverts commit ee92b82.
@armab As you can probably see from my commits I've hit a bit of a depedency hell trying to get requirement ranges that:
I can see in #6063 you've hopefully got I'll probably do the same as you here and split this into bit size PRs to make it more manageable. I did look at fixing If you think its worth our time adding that support, I'll take a look at updating the image as well :) |
@jk464 Your enhancement to fixate-requriements.py looks really clean. But overall I felt like env markers are buggy in many places, including older pip version we're locked to (because of py3.6) and even pants that doesn't support them in requirements-pants.txt so touching them might be like opening a can of worms. @cognifloyd do you think it's doable to migrate to the pants builds in the upcoming v3.9.0? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
With the changes extracted into a dedicated PRs one dependency at a time, let's make sure this PR updates only the following:
requests[security]
and importlib-metadata
I think that's the only thing left to update for security.
st2client/requirements.txt
Outdated
six==1.13.0 | ||
sseclient-py==1.7 | ||
typing-extensions<4.2 | ||
urllib3<2; python_version < '3.7' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, environment markers are all buggy with the current pip version 🤯
[package: st2] [20:53:43] The conflict is caused by:
[package: st2] [20:53:43] requests[security] 2.31.0 depends on urllib3<3 and >=1.21.1
[package: st2] [20:53:43] requests 2.31.0 depends on urllib3<3 and >=1.21.1
[package: st2] [20:53:43] st2client 3.9.dev0 depends on urllib3<2
which is wrong.
I can't see any path forward for updating requests[security]
so far as it requires urllib3
v2 which is incompatible with python3.6. And for some reason urllib3 v2 is pulled.
…1 for py3.8 (security) Extracted from #6062
So at least |
@armab if the build is failing for The only CVE I see listed against Let me know what you think and I can close this PR if there's nothing further to do |
@jk464 Yeah, let's reassign this PR to the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is no longer needed as we have dropped py3.6 in the master branch, and we've already bumped requests to 2.31.0.
Fixes up a host of CVEs in the
st2
package:Note: The
XRAY
references are vulnerabilities listed by JFrog Xray, that don't seem to have a corresponding CVE. JFrog doesn't seem to publish these references publicly - but I've linked to the issue disclosing the vulnerability thats referenced by theXRAY
entry.Bump cryptography to 41.0.4, pyopenssl to 23.2.0
Fixes:
pyopenssl 23.2.0 required for cryptography to 41.0.x support
Bump virtualenv to 20.16.7
Fixes:
Bump importlib-metadata to 4.10.1
Fixes:
Bump requests to 2.31.0
Fixes:
Bump gitpython to 3.1.37
Fixes:
Supercedes/Implements