forked from opendatahub-io/text-generation-inference
-
Notifications
You must be signed in to change notification settings - Fork 8
Commit bcae363
authored
Update deps to address vulnerability (#71)
#### Motivation
Address high vulnerability
Closes: https://issues.redhat.com/browse/RHOAIENG-4329
CVE info: https://www.cve.org/CVERecord?id=CVE-2024-27318
and https://www.cve.org/CVERecord?id=CVE-2024-27319
From SNYK report:
Detailed paths
Introduced through: [email protected] › [email protected]
Introduced through: [email protected] › [email protected] ›
[email protected]
Security information
Factors contributing to the scoring:
Snyk: [CVSS 7.5](https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-6231769)
- High Severity
NVD: Not available. NVD has not yet published its analysis.
[Why are the scores different? Learn how Snyk evaluates vulnerability
scores](https://docs.snyk.io/features/fixing-and-prioritizing-issues/issue-management/severity-levels#understanding-snyks-vulnerability-analysis)
Overview
[onnx](https://pypi.org/project/onnx) is an Open Neural Network Exchange
Affected versions of this package are vulnerable to Directory Traversal
due to unsafe path manipulation in external_data_helper.py. An attacker
can traverse up the directory tree from a base path to expose files
outside the intended working directory. This is a bypass for the
previously reported
[CVE-2022-25882](https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479).
[Describe why this change is needed]
#### Modifications
[Describe the code changes]
#### Result
[Describe how the changes affects existing behavior and how to test it]
#### Related Issues
[Resolves opendatahub-io#123]
Signed-off-by: heyselbi <[email protected]>1 parent 545bbf6 commit bcae363Copy full SHA for bcae363
File tree
Expand file treeCollapse file tree
2 files changed
+1985
-1778
lines changedFilter options
- server
Expand file treeCollapse file tree
2 files changed
+1985
-1778
lines changed
0 commit comments