RHAIENG-4014: constrain nltk to 3.9.4 for rhoai-2.25#2050
Conversation
|
Skipping CI for Draft Pull Request. |
📝 WalkthroughWalkthroughA new constraints file is introduced to manage CVE-related dependency version requirements. The file contains formatting instructions for use with Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/build-konflux |
Add a CVE constraint for nltk and refresh the affected pytorch+llmcompressor workbench and runtime locks on rhoai-2.25 so the shipped images stop resolving the vulnerable 3.9.2 release. Made-with: Cursor
Keep the z-stream fix focused on the CVE constraint and regenerated locks by dropping the exploratory Makefile and pylocks generator changes from this branch. Made-with: Cursor
jiridanek
force-pushed
the
fix/RHAIENG-4014-cve-nltk-rhoai-2-25
branch
from
2d66a98 to
e65b74b
Compare
|
/build-konflux |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@dependencies/cve-constraints.txt`:
- Around line 10-12: Replace the current Red Hat advisory comment for
CVE-2026-33236 with public advisories: update the top comment block that
references CVE-2026-33236 (above the dependency line "nltk>=3.9.4") to use the
NVD and GitHub advisory links instead (e.g., "Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-33236" and "GitHub advisory:
https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7") and
adjust the wording to note that nltk>=3.9.4 contains the fix.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 30efee96-694c-4e3c-871a-aaa812e2ff2a
📒 Files selected for processing (3)
dependencies/cve-constraints.txtjupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.tomlruntimes/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml
| # RHAIENG-4014: CVE-2026-33236 NLTK path traversal in XML index files | ||
| # Reference: https://access.redhat.com/security/cve/CVE-2026-33236 | ||
| nltk>=3.9.4 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Does CVE-2026-33236 exist and what is the minimum NLTK version that fixes it?
💡 Result:
Yes, CVE-2026-33236 exists. It is a path traversal vulnerability in the NLTK downloader that affects versions 3.9.3 and prior. The issue is fixed in commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a from March 18, 2026. NLTK 3.9.4, released on March 24, 2026, includes this fix along with several security enhancements.
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-33236
- 2: nltk/nltk@89fe2ec
- 3: GHSA-469j-vmhf-r6v7
- 4: https://raw.githubusercontent.com/nltk/nltk/master/ChangeLog
- 5: https://pypi.org/project/nltk/
🌐 Web query:
Is the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-33236 valid and accessible?
💡 Result:
No, the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-33236 is not valid in the sense of providing specific security details or affected products for CVE-2026-33236. The page exists and is accessible publicly, but it displays only generic Red Hat Customer Portal content (e.g., login prompts, links to subscriptions, support) without any CVE-specific information such as description, severity, affected products, or patches. This indicates Red Hat has not yet published a full advisory for this CVE. CVE-2026-33236 is a real vulnerability in NLTK (Natural Language Toolkit) involving path traversal in the downloader via remote XML index files, allowing arbitrary file creation/overwrite (CVSS 8.1 High, published 2026-03-20). Red Hat has tracked it in Bugzilla (BZ 2449824, status NEW, high priority, Security Response product), confirming awareness, but no RHSA or affected products are listed in public sources. It does not appear in recent RHSAs (e.g., RHSA-2026:3360, RHSA-2026:2664) or the Red Hat Security API CVE list.
Citations:
- 1: https://access.redhat.com/security/cve/CVE-2026-33236
- 2: https://access.redhat.com/security/cve/cve-2026-33236
- 3: https://bugzilla.redhat.com/show_bug.cgi?id=2449824
- 4: https://nvd.nist.gov/vuln/detail/CVE-2026-33236
- 5: https://www.tenable.com/cve/CVE-2026-33236
Update advisory reference for accuracy.
CVE-2026-33236 is confirmed as a real path traversal vulnerability in NLTK affecting versions 3.9.3 and prior, with NLTK 3.9.4 (released March 24, 2026) containing the fix. However, the Red Hat advisory link does not currently contain detailed CVE information—Red Hat is tracking the vulnerability but has not yet published a public RHSA. Update the reference to point to the publicly available advisories instead:
Updated comment (recommended)
# CVE-2026-33236: NLTK path traversal in XML index files
# Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33236
# GitHub advisory: https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7
nltk>=3.9.4
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@dependencies/cve-constraints.txt` around lines 10 - 12, Replace the current
Red Hat advisory comment for CVE-2026-33236 with public advisories: update the
top comment block that references CVE-2026-33236 (above the dependency line
"nltk>=3.9.4") to use the NVD and GitHub advisory links instead (e.g.,
"Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33236" and "GitHub
advisory: https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7")
and adjust the wording to note that nltk>=3.9.4 contains the fix.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ide-developer The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
jiridanek
merged commit 9a69748
into
red-hat-data-services:rhoai-2.25
2 participants
https://redhat.atlassian.net/browse/RHAIENG-4014
Summary
nltk>=3.9.4onrhoai-2.25pytorch+llmcompressorworkbench and runtimepylock.tomlfilesnltkresolution from3.9.2to3.9.4Root Cause
rhoai-2.25shippednltk 3.9.2transitively in thepytorch+llmcompressorworkbench and runtime images, which kept the vulnerable version in the released lock state for those two image families.Changes
dependencies/cve-constraints.txtnltk>=3.9.4forCVE-2026-33236jupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.tomlnltkis upgraded to3.9.4runtimes/pytorch+llmcompressor/ubi9-python-3.12/pylock.tomlnltkis upgraded to3.9.4Test Results
gmake test: passed./uv run pytest tests/unit/: not runnable on this branch becausetests/unit/is absent./uv run ruff check: fails on unrelated existingtests/__init__.py./uv run pyright: fails on unrelated existingci/check-software-versions.pyThis PR is draft because the branch has baseline verification issues outside the fix scope.
Jira
https://redhat.atlassian.net/browse/RHAIENG-4014
Made with Cursor
Summary by CodeRabbit