Skip to content

Commit bcae363

Browse files
authored
Update deps to address vulnerability (#71)
#### Motivation Address high vulnerability Closes: https://issues.redhat.com/browse/RHOAIENG-4329 CVE info: https://www.cve.org/CVERecord?id=CVE-2024-27318 and https://www.cve.org/CVERecord?id=CVE-2024-27319 From SNYK report: Detailed paths Introduced through: [email protected][email protected] Introduced through: [email protected][email protected][email protected] Security information Factors contributing to the scoring: Snyk: [CVSS 7.5](https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-6231769) - High Severity NVD: Not available. NVD has not yet published its analysis. [Why are the scores different? Learn how Snyk evaluates vulnerability scores](https://docs.snyk.io/features/fixing-and-prioritizing-issues/issue-management/severity-levels#understanding-snyks-vulnerability-analysis) Overview [onnx](https://pypi.org/project/onnx) is an Open Neural Network Exchange Affected versions of this package are vulnerable to Directory Traversal due to unsafe path manipulation in external_data_helper.py. An attacker can traverse up the directory tree from a base path to expose files outside the intended working directory. This is a bypass for the previously reported [CVE-2022-25882](https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479). [Describe why this change is needed] #### Modifications [Describe the code changes] #### Result [Describe how the changes affects existing behavior and how to test it] #### Related Issues [Resolves #123] Signed-off-by: heyselbi <[email protected]>
1 parent 545bbf6 commit bcae363

File tree

2 files changed

+1985
-1778
lines changed

2 files changed

+1985
-1778
lines changed

0 commit comments

Comments
 (0)