Skip to content

Commit 40bc439

Browse files
alexander-smolyakovalexander-smolyakov
authored
[anaconda & miniconda] Update requests package due to CVE-2023-32681 (devcontainers#578)
* [anaconda] Update `requests` package due to CVE-2023-32681 - Update Dockerfile to install the latest requests package version; - Added test to verify requests minimum version; - Updated manifest to include info about the requests package; - Refactored tests; * [miniconda] Update `requests` package due to CVE-2023-32681 - Update Dockerfile to install the latest requests package version; - Added test to verify requests minimum version; - Updated manifest to include info about the requests package; - Refactored tests; * Reorg tests
1 parent 1f4139d commit 40bc439

File tree

8 files changed

+46
-46
lines changed

8 files changed

+46
-46
lines changed

‎src/anaconda/.devcontainer/Dockerfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,9 @@ RUN python3 -m pip install \
5959
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25577
6060
werkzeug \
6161
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32862
62-
nbconvert
62+
nbconvert \
63+
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32681
64+
requests
6365

6466
# Copy environment.yml (if found) to a temp location so we can update the environment. Also
6567
# copy "noop.txt" so the COPY instruction does not fail if no environment.yml exists.

‎src/anaconda/manifest.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@
3636
"nbconvert",
3737
"py",
3838
"pyOpenssl",
39-
"werkzeug"
39+
"werkzeug",
40+
"requests"
4041
],
4142
"other": {
4243
"git": {},

‎src/anaconda/test-project/test-utils.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,3 +162,12 @@ fixTestProjectFolderPrivs() {
162162
fi
163163
fi
164164
}
165+
166+
checkPythonPackageVersion()
167+
{
168+
PACKAGE=$1
169+
REQUIRED_VERSION=$2
170+
171+
current_version=$(python -c "import ${PACKAGE}; print(${PACKAGE}.__version__)")
172+
check-version-ge "${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
173+
}

‎src/anaconda/test-project/test.sh‎

Lines changed: 12 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -29,42 +29,22 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont
2929

3030
check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"
3131

32-
joblib_version=$(python -c "import joblib; print(joblib.__version__)")
33-
check-version-ge "joblib-requirement" "${joblib_version}" "1.2.0"
34-
35-
cookiecutter_version=$(python -c "import cookiecutter; print(cookiecutter.__version__)")
36-
check-version-ge "cookiecutter-requirement" "${cookiecutter_version}" "2.1.1"
37-
38-
cryptography_version=$(python -c "import cryptography; print(cryptography.__version__)")
39-
check-version-ge "cryptography-requirement" "${cryptography_version}" "38.0.3"
40-
41-
mistune_version=$(python -c "import mistune; print(mistune.__version__)")
42-
check-version-ge "mistune-requirement" "${mistune_version}" "2.0.3"
43-
44-
numpy_version=$(python -c "import numpy; print(numpy.__version__)")
45-
check-version-ge "numpy-requirement" "${numpy_version}" "1.22"
46-
47-
setuptools_version=$(python -c "import setuptools; print(setuptools.__version__)")
48-
check-version-ge "setuptools-requirement" "${setuptools_version}" "65.5.1"
49-
50-
future_version=$(python -c "import future; print(future.__version__)")
51-
check-version-ge "future-requirement" "${future_version}" "0.18.3"
52-
53-
wheel_version=$(python -c "import wheel; print(wheel.__version__)")
54-
check-version-ge "wheel-requirement" "${wheel_version}" "0.38.1"
55-
56-
nbconvert_version=$(python -c "import nbconvert; print(nbconvert.__version__)")
57-
check-version-ge "nbconvert-requirement" "${nbconvert_version}" "6.5.1"
32+
checkPythonPackageVersion "joblib" "1.2.0"
33+
checkPythonPackageVersion "cookiecutter" "2.1.1"
34+
checkPythonPackageVersion "cryptography" "38.0.3"
35+
checkPythonPackageVersion "mistune" "2.0.3"
36+
checkPythonPackageVersion "numpy" "1.22"
37+
checkPythonPackageVersion "setuptools" "65.5.1"
38+
checkPythonPackageVersion "future" "0.18.3"
39+
checkPythonPackageVersion "wheel" "0.38.1"
40+
checkPythonPackageVersion "nbconvert" "6.5.1"
41+
checkPythonPackageVersion "werkzeug" "2.2.3"
42+
checkPythonPackageVersion "certifi" "2022.12.07"
43+
checkPythonPackageVersion "requests" "2.31.0"
5844

5945
check "conda-update-conda" bash -c "conda update -y conda"
6046
check "conda-install" bash -c "conda install -c conda-forge --yes tensorflow"
6147
check "conda-install" bash -c "conda install -c conda-forge --yes pytorch"
6248

63-
werkzeug_version=$(python -c "import werkzeug; print(werkzeug.__version__)")
64-
check-version-ge "werkzeug-requirement" "${werkzeug_version}" "2.2.3"
65-
66-
certifi_version=$(python -c "import certifi; print(certifi.__version__)")
67-
check-version-ge "certifi-requirement" "${certifi_version}" "2022.12.07"
68-
6949
# Report result
7050
reportResults

‎src/miniconda/.devcontainer/Dockerfile‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,11 @@ COPY environment.yml* noop.txt /tmp/conda-tmp/
3939
RUN if [ -f "/tmp/conda-tmp/environment.yml" ]; then umask 0002 && /opt/conda/bin/conda env update -n base -f /tmp/conda-tmp/environment.yml; fi \
4040
&& rm -rf /tmp/conda-tmp
4141

42-
# [Optional] Uncomment this section to install updates/additional Python packages.
43-
# RUN python3 -m conda update -y \
44-
# <your-package-list-here>
42+
# Temporary: Upgrade python packages due to mentioned CVEs
43+
# They are installed by the base image (continuumio/miniconda3) which does not have the patch.
44+
RUN python3 -m pip install --upgrade \
45+
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32681
46+
requests
4547

4648
# [Optional] Uncomment this section to install additional OS packages.
4749
# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \

‎src/miniconda/manifest.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@
4141
"cryptography",
4242
"pyOpenssl",
4343
"setuptools",
44-
"wheel"
44+
"wheel",
45+
"requests"
4546
],
4647
"other": {
4748
"git": {},

‎src/miniconda/test-project/test-utils.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,3 +163,12 @@ fixTestProjectFolderPrivs() {
163163
fi
164164
fi
165165
}
166+
167+
checkPythonPackageVersion()
168+
{
169+
PACKAGE=$1
170+
REQUIRED_VERSION=$2
171+
172+
current_version=$(python -c "import ${PACKAGE}; print(${PACKAGE}.__version__)")
173+
check-version-ge "${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
174+
}

‎src/miniconda/test-project/test.sh‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,14 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont
1818

1919
check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"
2020

21-
cryptography_version=$(python -c "import cryptography; print(cryptography.__version__)")
22-
check-version-ge "cryptography-requirement" "${cryptography_version}" "38.0.3"
21+
checkPythonPackageVersion "cryptography" "38.0.3"
22+
checkPythonPackageVersion "setuptools" "65.5.1"
23+
checkPythonPackageVersion "wheel" "0.38.1"
24+
checkPythonPackageVersion "requests" "2.31.0"
2325

2426
check "conda-update-conda" bash -c "conda update -y conda"
2527
check "conda-install" bash -c "conda install -c conda-forge --yes tensorflow"
2628
check "conda-install" bash -c "conda install -c conda-forge --yes pytorch"
2729

28-
setuptools_version=$(python -c "import setuptools; print(setuptools.__version__)")
29-
check-version-ge "setuptools-requirement" "${setuptools_version}" "65.5.1"
30-
31-
wheel_version=$(python -c "import wheel; print(wheel.__version__)")
32-
check-version-ge "wheel-requirement" "${wheel_version}" " 0.38.1"
33-
3430
# Report result
3531
reportResults

0 commit comments

Comments
 (0)