fix(deps): bump fastapi >=0.115.0 and python-multipart >=0.0.20 (7 HIGH CVEs) - #1409
Open
aeonframework wants to merge 2 commits into
Open
fix(deps): bump fastapi >=0.115.0 and python-multipart >=0.0.20 (7 HIGH CVEs)#1409aeonframework wants to merge 2 commits into
aeonframework wants to merge 2 commits into
Conversation
- fastapi>=0.95.0 → >=0.115.0 (pulls in starlette>=0.40.0, closing 3 HIGH CVEs in the starlette CORS/routing layer) - python-multipart>=0.0.6 → >=0.0.20 (closes 4 HIGH ReDoS CVEs in the multipart form parser — GHSA-2jv5-9r88-3w3p, GHSA-qf8r-vq9x-qr8g and related) Note: python-jose pulls in ecdsa (CRITICAL, CVE-2024-23342). Consider replacing python-jose with python-jwt or authlib which do not depend on ecdsa for ECDSA ops.
…y too This PR raised the CVE floors (fastapi>=0.115.0, python-multipart>=0.0.20) in requirements.txt only. The same two deps were left at fastapi>=0.104.0 / python-multipart>=0.0.6 in pyproject.toml and archive/v1/setup.py, so a wheel build / pip install . could still resolve the vulnerable versions. This completes the floor across all three manifests. Thanks to @PrinceAudre for catching the gap in ruvnet#1425.
Author
|
Updated — folded the Thanks @PrinceAudre for catching the gap in #1425 — this supersedes it, so #1425 can be closed once this lands. @ruvnet ready for review whenever you have a moment. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security dep bump
Automated security update to close 7 HIGH CVEs in pinned Python dependency lower bounds.
Changes
fastapi>=0.95.0>=0.115.0python-multipart>=0.0.6>=0.0.20Details
python-multipart < 0.0.20 — four HIGH-severity ReDoS vulnerabilities in the multipart form-data parser. A crafted
Content-Typeor boundary value causes catastrophic backtracking, enabling a denial-of-service condition against any endpoint that accepts file/form uploads.fastapi < 0.115.0 / starlette < 0.40.0 — multiple HIGH-severity issues in the starlette layer (CORS origin validation bypass, header injection in redirect responses). fastapi 0.115.0+ pulls in a starlette release that patches all three.
Additional note
python-jose[cryptography]>=3.3.0transitively installsecdsa, which has a CRITICAL timing-side-channel CVE (CVE-2024-23342). The ecdsa package appears to be end-of-life. Recommend migrating topython-jwtorauthlibwhich implement ECDSA natively without ecdsa. (Out of scope for this PR — needs API surface review.)Reported and patched by aeonframework automated security scanner.