Skip to content

[anaconda] Address GHSA-47fc-vmwq-366v, GHSA-282v-666c-3fvg, GHSA-mrwq-x4v8-fh7p vulnerabilities #690

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 18 commits into from
Aug 14, 2023
Merged

[anaconda] Address GHSA-47fc-vmwq-366v, GHSA-282v-666c-3fvg, GHSA-mrwq-x4v8-fh7p vulnerabilities #690

Changes from 1 commit
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
e8e1ce1
Address GHSA-47fc-vmwq-366v, GHSA-282v-666c-3fvg, GHSA-mrwq-x4v8-fh7p
alexander-smolyakov Aug 1, 2023
6f2dfc4
Add tests
alexander-smolyakov Aug 1, 2023
ea458af
Update manifest
alexander-smolyakov Aug 1, 2023
597e8eb
Bump `pygments` version
alexander-smolyakov Aug 1, 2023
4401785
Test: Remove `conda` group
alexander-smolyakov Aug 1, 2023
1595396
Restart checks
alexander-smolyakov Aug 1, 2023
2cc4085
Test: Reorg Dockerfile
alexander-smolyakov Aug 1, 2023
66ad4be
Revert "Test: Reorg Dockerfile"
alexander-smolyakov Aug 1, 2023
084cd96
Revert "Test: Remove `conda` group"
alexander-smolyakov Aug 1, 2023
99f5641
Merge remote-tracking branch 'upstream/main' into anaconda_GHSA-47fc-…
alexander-smolyakov Aug 9, 2023
5a66c9a
Merge remote-tracking branch 'upstream/main' into anaconda_GHSA-47fc-…
alexander-smolyakov Aug 9, 2023
2698391
Use latest version of `continuumio/anaconda3` image
alexander-smolyakov Aug 11, 2023
cc98ca9
Update tests
alexander-smolyakov Aug 11, 2023
94a7ada
Merge remote-tracking branch 'upstream/main' into anaconda_GHSA-47fc-…
alexander-smolyakov Aug 14, 2023
a5bac20
Update patch
alexander-smolyakov Aug 14, 2023
42d75ba
Update README.md
alexander-smolyakov Aug 14, 2023
c642c0e
Update src/anaconda/README.md
alexander-smolyakov Aug 14, 2023
a64f971
Revert changes for manifest
alexander-smolyakov Aug 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
Address GHSA-47fc-vmwq-366v, GHSA-282v-666c-3fvg, GHSA-mrwq-x4v8-fh7p
  • Loading branch information
@alexander-smolyakov
alexander-smolyakov committed Aug 1, 2023
commit e8e1ce1a9cc7c7b497273df0552d575e93e9d726
12 changes: 9 additions & 3 deletions src/anaconda/.devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,12 @@ RUN python3 -m pip install \
werkzeug \
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32862
nbconvert \
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28370
tornado
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28370
tornado \
# https://github.com/advisories/GHSA-47fc-vmwq-366v
torch==1.13.1 \
# https://github.com/advisories/GHSA-282v-666c-3fvg
transformers==4.30.0

# Copy environment.yml (if found) to a temp location so we can update the environment. Also
# copy "noop.txt" so the COPY instruction does not fail if no environment.yml exists.
Expand All @@ -79,7 +83,9 @@ RUN conda install \
pyopenssl=23.2.0 \
cryptography=41.0.2 \
# https://github.com/advisories/GHSA-j8r2-6x86-q33q
requests=2.31.0
requests=2.31.0 \
# https://github.com/advisories/GHSA-mrwq-x4v8-fh7p
pygments=2.15.0

# Create conda group, update conda directory permissions,
# add user to conda group
Expand Down