Skip to content

Latest vulnerability fixes #127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shankari merged 5 commits into from
Apr 9, 2024
Merged

Latest vulnerability fixes #127

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7391c53
Latest vulnerability fixes - ip
Apr 5, 2024
8ff17fe
Updating pillow version
Apr 5, 2024
fe4e3a0
Whitespace fix
MukuFlash03 Apr 5, 2024
9a9cf4c
Updated Docker image tag
Apr 8, 2024
7ad5173
Reverted addition of pillow package
Apr 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion frontend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM node:21.5.0-alpine
FROM node:21.7.2-alpine
VOLUME /public/plots

RUN mkdir -p /public
Expand Down
2 changes: 1 addition & 1 deletion frontend/docker/Dockerfile.dev
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM node:21.5.0-alpine
FROM node:21.7.2-alpine

RUN mkdir -p /public
WORKDIR /public
Expand Down
2 changes: 1 addition & 1 deletion viz_scripts/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# python 3
FROM shankari/e-mission-server:master_2024-02-10--19-38
FROM shankari/e-mission-server:master_2024-04-08--17-44

VOLUME /plots

Expand Down
2 changes: 1 addition & 1 deletion viz_scripts/docker/Dockerfile.dev
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# python 3
FROM shankari/e-mission-server:master_2024-02-10--19-38
FROM shankari/e-mission-server:master_2024-04-08--17-44

VOLUME /plots

Expand Down
2 changes: 2 additions & 0 deletions viz_scripts/docker/environment36.dashboard.additions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,5 @@ dependencies:
- pip:
- nbparameterise==0.6
- devcron==0.4
- pillow==10.3.0
Copy link
Contributor

@shankari shankari Apr 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are we adding pillow here?
There was no pillow before, so it should not have resulted in a CVE

Copy link
Contributor Author

@MukuFlash03 MukuFlash03 Apr 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, I thought the same when fixing this but AWS listed pillow as a vulnerability in the viz_scripts container.
It's not a CVE though, its a SNYK-PYTHON category.
When I was last saw it, the Status column mentioned SUPPRESSED, while now it says CLOSED.

Screenshot 2024-04-08 at 2 53 08 PM

I've removed the pillow version added here.

Also, I've confirmed that for admin-dash container as well the vulnerability has been marked with status CLOSED.

Screenshot 2024-04-08 at 3 02 12 PM