Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update pip Version for cimg/python:3.7.7 #84

Closed
danhlee329 opened this issue May 4, 2021 · 1 comment
Closed

Update pip Version for cimg/python:3.7.7 #84

danhlee329 opened this issue May 4, 2021 · 1 comment

Comments

@danhlee329
Copy link

danhlee329 commented May 4, 2021

When running pipenv run safety check --full-report with base image cimg/python:3.7.7 in a CircleCI job, getting security finding below:

#!/bin/bash -eo pipefail
pipenv run safety check --full-report

safety report
checked 39 packages, using free DB (updated once a month)
---
-> pip, installed 20.1.1, affected <21.1, id 40291
Pip 21.1 stops splitting on unicode separators in git references, which could be maliciously used to install a different revision on the repository. See: <https://github.com/pypa/pip/issues/9827>. Additionally, pip 21.1 updates urllib3 to 1.26.4 to fix CVE-2021-28363.
--

Exited with code exit status 255
CircleCI received exit code 255

Able to workaround this by running command pipenv run pip3 install --upgrade pip, but would like to see if pip can be upgraded.

@danhlee329 danhlee329 changed the title Update pip Version for cimg/python:3.7.7 Update 'pip' Version for cimg/python:3.7.7 May 4, 2021
@danhlee329 danhlee329 changed the title Update 'pip' Version for cimg/python:3.7.7 Update pip Version for cimg/python:3.7.7 May 4, 2021
@FelicianoTech
Copy link
Contributor

We wouldn't update the image. So either you need to update it yourself, as mentioned, or use a newer Python image which would contain a newer pip version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants