Skip to content

Commit f2462a8

Browse files
authored
updating requests to address CVEs CVE-2024-35195 and CVE-2024-47081 (#167)
Signed-off-by: Adam D. Cornett <adc@redhat.com>
1 parent 9a73491 commit f2462a8

File tree

4 files changed

+8
-14
lines changed

4 files changed

+8
-14
lines changed

images/ansible-operator/Dockerfile

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,7 @@ RUN set -e && dnf clean all && rm -rf /var/cache/dnf/* \
2727
&& pip3 install --upgrade pip~=23.3.2 \
2828
&& pip3 install pipenv==2023.11.15 \
2929
&& pipenv install --deploy \
30-
# NOTE: This ignored vulnerability (71064) was detected in requests, \
31-
# but the upgraded version doesn't support the use case (protocol we are using).\
32-
# Ref: https://github.com/operator-framework/ansible-operator-plugins/pull/67#issuecomment-2189164688 \
33-
&& pipenv check --ignore 71064 --ignore 77680 \
30+
&& pipenv check \
3431
&& dnf remove -y gcc libffi-devel openssl-devel python3.12-devel \
3532
&& dnf clean all \
3633
&& rm -rf /var/cache/dnf

images/ansible-operator/Pipfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ ansible-runner-http = "~=1.0.0"
99
ansible-core = "~=2.18.3"
1010
urllib3 = "~=2.5.0"
1111
kubernetes = "==33.1.0"
12-
requests = "~=2.31.0"
12+
requests = "~=2.32.5"
1313

1414
[dev-packages]
1515

images/ansible-operator/Pipfile.lock

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

images/ansible-operator/pipfile.Dockerfile

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,7 @@ RUN set -e && dnf clean all && rm -rf /var/cache/dnf/* \
2323
&& pip3 install --upgrade pip~=23.3.2 \
2424
&& pip3 install pipenv==2023.11.15 \
2525
&& pipenv lock \
26-
# NOTE: This ignored vulnerability (71064) was detected in requests, \
27-
# but the upgraded version doesn't support the use case (protocol we are using).\
28-
# Ref: https://github.com/operator-framework/ansible-operator-plugins/pull/67#issuecomment-2189164688
29-
&& pipenv check --ignore 71064 --ignore 77680 \
26+
&& pipenv check \
3027
&& dnf remove -y gcc libffi-devel openssl-devel python3.12-devel \
3128
&& dnf clean all \
3229
&& rm -rf /var/cache/dnf

0 commit comments

Comments
 (0)