Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: ⬆️ vulnerability upgrade ujson -> fastapi #2762

Closed

Conversation

pcrespov
Copy link
Member

@pcrespov pcrespov commented Jan 24, 2022

What do these changes do?

CVE-2021-45958
High severity
Vulnerable versions: >= 4.0.2, < 5.1.0
Patched version: 5.1.0
UltraJSON (aka ujson) 4.0.2 through 5.0.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).

Related issue/s

CVE-2021-45958

How to test

all tests shall pass

Checklist

  • upgrade repo-wide fastapi when ujson constraint is removed
  • Openapi changes? make openapi-specs, git commit ... and then make version-*)
  • Database migration script? cd packages/postgres-database, make setup-commit, sc-pg review -m "my changes"
  • Unit tests for the changes exist
  • Runs in the swarm
  • Documentation reflects the changes
  • New module? Add your github username to .github/CODEOWNERS
    -->

@pcrespov pcrespov self-assigned this Jan 24, 2022
@pcrespov pcrespov changed the title WIP: ⬆️ vulnerability upgrade WIP: ⬆️ vulnerability upgrade ujson -> fastapi Jan 24, 2022
@codecov
Copy link

codecov bot commented Jan 24, 2022

Codecov Report

Merging #2762 (6378b14) into master (cf7791f) will increase coverage by 0.0%.
The diff coverage is n/a.

Impacted file tree graph

@@          Coverage Diff           @@
##           master   #2762   +/-   ##
======================================
  Coverage    78.8%   78.8%           
======================================
  Files         680     680           
  Lines       27101   27101           
  Branches     2633    2633           
======================================
+ Hits        21362   21370    +8     
+ Misses       4995    4988    -7     
+ Partials      744     743    -1     
Flag Coverage Δ
integrationtests 65.8% <ø> (+<0.1%) ⬆️
unittests 74.4% <ø> (+<0.1%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
.../director/src/simcore_service_director/producer.py 62.6% <0.0%> (+0.8%) ⬆️
...ector_v2/modules/comp_scheduler/background_task.py 86.2% <0.0%> (+7.8%) ⬆️

@pcrespov pcrespov modified the milestones: Rudolph, Rudolph+1 Feb 4, 2022
@pcrespov
Copy link
Member Author

Too many conflicts. worth re-doing

@pcrespov pcrespov closed this Feb 20, 2022
@pcrespov pcrespov deleted the maintenance/upgrade-ujson branch February 20, 2022 17:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant