Skip to content

Conversation

gauravsaini04
Copy link
Contributor

@gauravsaini04 gauravsaini04 commented Feb 14, 2024

Dev container name:

  • Miniconda

Description:

This PR patches the following vulnerability:

This vulnerability comes from the coninuumio/miniconda3 image used upstream for the Miniconda devcontainer.

Changelog:

  • Updated Dockerfile

    • Upgraded version for patched conda package;
      • cryptography - minimum package version is set to 42.0.2;
    • Upgraded version for patched python package;
      • pyopenssl - minimum package version is set to 24.0.0 ( for compatibility with cryptography v42.0.2 );
  • Updated tests to verify the following:

    • cryptography minimum version (Minimum package version set to 42.0.2 which fixes GHSA-3ww4-gg4f-jr7f);
    • pyopenssl minimum version (Minimum package version set to 24.0.0 which is compatible with cryptography v42.0.2;

Checklist:

  • Checked that applied changes work as expected

@gauravsaini04 gauravsaini04 marked this pull request as ready for review February 15, 2024 05:58
@gauravsaini04 gauravsaini04 requested a review from a team as a code owner February 15, 2024 05:59
Copy link
Member

@samruddhikhandale samruddhikhandale left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@samruddhikhandale samruddhikhandale merged commit 9bb5c4f into devcontainers:main Feb 16, 2024
@gauravsaini04 gauravsaini04 deleted the miniconda_cryptography_GHSA-3ww4-gg4f-jr7f branch February 16, 2024 23:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants