Preview/OSV scanner #82
Conversation
WalkthroughAdds six new runtime dependencies in requirements.txt: ecdsa==0.19.1, fastapi==0.104.1, jinja2==3.1.2, python-jose==3.3.0, python-multipart==0.0.6, and starlette==0.27.0. No source code changes are included. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
requirements.txt(1 hunks)
🧰 Additional context used
🪛 OSV Scanner (2.2.2)
requirements.txt
[HIGH] 1-1: ecdsa 0.19.1: Minerva timing attack on P-256 in python-ecdsa
[HIGH] 2-2: fastapi 0.104.1: undefined
(PYSEC-2024-38)
[HIGH] 3-3: jinja2 3.1.2: Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
[HIGH] 3-3: jinja2 3.1.2: Jinja has a sandbox breakout through malicious filenames
[HIGH] 3-3: jinja2 3.1.2: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
[HIGH] 3-3: jinja2 3.1.2: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
[HIGH] 3-3: jinja2 3.1.2: Jinja has a sandbox breakout through indirect reference to format method
[CRITICAL] 4-4: python-jose 3.3.0: undefined
(PYSEC-2024-232)
[CRITICAL] 4-4: python-jose 3.3.0: undefined
(PYSEC-2024-233)
[CRITICAL] 4-4: python-jose 3.3.0: python-jose algorithm confusion with OpenSSH ECDSA keys
[CRITICAL] 4-4: python-jose 3.3.0: python-jose denial of service via compressed JWE content
[HIGH] 5-5: python-multipart 0.0.6: python-multipart vulnerable to Content-Type Header ReDoS
[HIGH] 5-5: python-multipart 0.0.6: Denial of service (DoS) via deformation multipart/form-data boundary
[HIGH] 6-6: starlette 0.27.0: Starlette has possible denial-of-service vector when parsing large files in multipart forms
[HIGH] 6-6: starlette 0.27.0: Starlette Denial of service (DoS) via multipart/form-data
| ecdsa==0.19.1 | ||
| fastapi==0.104.1 | ||
| jinja2==3.1.2 | ||
| python-jose==3.3.0 | ||
| python-multipart==0.0.6 | ||
| starlette==0.27.0 No newline at end of file |
There was a problem hiding this comment.
Blocker: Newly added pins introduce known high/critical CVEs
Every dependency added in this hunk is flagged by OSV/GHSA with active HIGH or CRITICAL vulnerabilities:
ecdsa==0.19.1→ GHSA-wj6h-64fc-37mp (Minerva timing attack).fastapi==0.104.1→ PYSEC-2024-38 (security advisory published for this release).jinja2==3.1.2→ multiple sandbox breakout/XSS advisories (GHSA-cpwx-vrp4-4pq7, GHSA-gmj6-6f8f-6699, GHSA-h5c8-rqwp-cp95, GHSA-h75v-3vvj-5mfj, GHSA-q2x7-8rv6-6q7h).python-jose==3.3.0→ critical algorithm-confusion and decompression DoS issues (GHSA-6c5p-j8vq-pqhj, GHSA-cjwg-qfpm-7377, PYSEC-2024-232/233).python-multipart==0.0.6→ multiple multipart parsing DoS advisories (GHSA-2jv5-9r88-3w3p, GHSA-59g5-xgcq-4qw3).starlette==0.27.0→ multipart DoS advisories (GHSA-2c2j-9gv5-cj73, GHSA-f96h-pmfr-66vw).
Please update each pin to a version that is listed as patched in the corresponding advisory (or apply an alternative mitigation/library if no fixed release exists yet) before merging. Right now this PR would ship known-vulnerable packages into production.
🧰 Tools
🪛 OSV Scanner (2.2.2)
[HIGH] 1-1: ecdsa 0.19.1: Minerva timing attack on P-256 in python-ecdsa
[HIGH] 2-2: fastapi 0.104.1: undefined
(PYSEC-2024-38)
[HIGH] 3-3: jinja2 3.1.2: Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
[HIGH] 3-3: jinja2 3.1.2: Jinja has a sandbox breakout through malicious filenames
[HIGH] 3-3: jinja2 3.1.2: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
[HIGH] 3-3: jinja2 3.1.2: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
[HIGH] 3-3: jinja2 3.1.2: Jinja has a sandbox breakout through indirect reference to format method
[CRITICAL] 4-4: python-jose 3.3.0: undefined
(PYSEC-2024-232)
[CRITICAL] 4-4: python-jose 3.3.0: undefined
(PYSEC-2024-233)
[CRITICAL] 4-4: python-jose 3.3.0: python-jose algorithm confusion with OpenSSH ECDSA keys
[CRITICAL] 4-4: python-jose 3.3.0: python-jose denial of service via compressed JWE content
[HIGH] 5-5: python-multipart 0.0.6: python-multipart vulnerable to Content-Type Header ReDoS
[HIGH] 5-5: python-multipart 0.0.6: Denial of service (DoS) via deformation multipart/form-data boundary
[HIGH] 6-6: starlette 0.27.0: Starlette has possible denial-of-service vector when parsing large files in multipart forms
[HIGH] 6-6: starlette 0.27.0: Starlette Denial of service (DoS) via multipart/form-data
🤖 Prompt for AI Agents
In requirements.txt lines 1-6 the newly added exact pins include versions with
known HIGH/CRITICAL CVEs (ecdsa 0.19.1, fastapi 0.104.1, jinja2 3.1.2,
python-jose 3.3.0, python-multipart 0.0.6, starlette 0.27.0); update each pinned
version to the minimum fixed/patched release cited in the corresponding
advisories (or replace with an alternative maintained library if no patched
release exists), verify the chosen versions against OSV/GHSA advisories, run
dependency checks (e.g., pip-audit/safety or GitHub Dependabot reports) to
confirm vulnerabilities are resolved, and update the requirements file with the
new safe pins before merging.
Summary by CodeRabbit