security: fix 4 HIGH CVEs - aiohttp 3.13.3, urllib3 2.6.3, pam, gnupg2

Author: neverinfamous

.scout-ignore

@@ -0,0 +1,73 @@
+# Unfixable LOW severity Debian packages - no upstream fix available
+# Last audited: 2026-01-12
+# These CVEs are acknowledged but cannot be remediated until Debian provides upstream fixes
+
+# tar - no Debian fix
+CVE-2025-45582
+CVE-2005-2541
+
+# glibc - core library, wontfix
+CVE-2019-9192
+CVE-2019-1010025
+CVE-2019-1010024
+CVE-2019-1010023
+CVE-2019-1010022
+CVE-2018-20796
+CVE-2010-4756
+
+# openldap - no fix
+CVE-2026-22185
+CVE-2020-15719
+CVE-2017-17740
+CVE-2017-14159
+CVE-2015-3276
+
+# systemd - no fix
+CVE-2023-31439
+CVE-2023-31438
+CVE-2023-31437
+CVE-2013-4392
+
+# sqlite3 - no fix
+CVE-2025-52099
+CVE-2025-29088
+CVE-2021-45346
+
+# krb5 - no fix
+CVE-2024-26461
+CVE-2024-26458
+CVE-2018-5709
+
+# coreutils - no fix
+CVE-2025-5278
+CVE-2017-18018
+
+# libgcrypt20 - no fix
+CVE-2024-2236
+CVE-2018-6829
+
+# openssl - no fix
+CVE-2025-27587
+CVE-2010-0928
+
+# perl - no fix
+CVE-2023-31486
+CVE-2011-4116
+
+# net-tools - no fix
+CVE-2002-1976
+
+# iputils - no fix
+CVE-2025-47268
+
+# gnutls28 - no fix
+CVE-2011-3389
+
+# util-linux - no fix
+CVE-2022-0563
+
+# apt - no fix
+CVE-2011-3374
+
+# gcc-12 - no fix
+CVE-2022-27943

Dockerfile

@@ -32,10 +32,12 @@ RUN groupadd -r app && useradd -r -g app -u 1000 app
 
 # Install runtime system dependencies
 # Removed dnsutils to fix CVE-2025-40777 (bind9 vulnerability)
+# Security: Upgrade pam (CVE-2025-6020) and gnupg2 (CVE-2025-68973) to latest patched versions
 RUN apt-get update && apt-get install -y \
   libpq-dev \
   iputils-ping \
   net-tools \
+  && apt-get upgrade -y libpam-modules libpam-runtime libpam0g gnupg gpg \
   && rm -rf /var/lib/apt/lists/* \
   && apt-get clean
 

pyproject.toml

@@ -16,9 +16,10 @@ dependencies = [
     "setuptools>=78.1.1",
     # Security: Force updated versions to fix CVEs (Dec 6, 2025 update)
     "starlette>=0.49.1",  # CVE-2025-62727, CVE-2025-54121
-    "urllib3>=2.6.0",     # CVE-2025-66471, CVE-2025-66418 (FIXED: upgraded from 2.5.0)
+    "urllib3>=2.6.3",     # CVE-2026-21441 (data amplification attack)
     "requests>=2.32.4",   # CVE-2024-47081
-    "aiohttp>=3.12.14",   # CVE-2025-53643
+    "aiohttp>=3.13.3",    # CVE-2025-69223 + 7 security fixes
+    "filelock>=3.20.1",   # CVE-2025-68146 (race condition fix)
 ]
 license = "mit"
 license-files = ["LICENSE"]