Skip to content

[Aikido] Fix 2 security issues in protobuf, requests#152

Open
aikido-autofix[bot] wants to merge 1 commit intodevelopfrom
fix/aikido-security-update-packages-28214937-sglx
Open

[Aikido] Fix 2 security issues in protobuf, requests#152
aikido-autofix[bot] wants to merge 1 commit intodevelopfrom
fix/aikido-security-update-packages-28214937-sglx

Conversation

@aikido-autofix
Copy link
Copy Markdown

Upgrade protobuf and requests to fix DoS vulnerability in nested Any message parsing and local file extraction vulnerability in temp directory handling.

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-0994
HIGH
[protobuf] ParseDict() fails to properly track recursion depth when handling nested Any messages, allowing attackers to bypass the max_recursion_depth limit and trigger a RecursionError, causing denial of service.
CVE-2026-25645
MEDIUM
[requests] The extract_zipped_paths() utility function uses predictable filenames when extracting zip archives to the temp directory, allowing local attackers to pre-create malicious files that get loaded instead of legitimate ones, resulting in arbitrary code execution.

@github-actions
Copy link
Copy Markdown
Contributor

Docker Images

Commit: 9e6f85b8e24a6c8e6cf1b9ee8e94e92665e57dd9

Tag
610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-9e6f85b

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants