project-codeflare / project-codeflare/codeflare-sdk

Security vulnerability in cryptography package

Open
#385 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
35
Forks
66
Avg merge
48m
Merged PRs (30d)
7

Description

Describe the Bug

The cryptography package v40.0.2 imported in Codeflare SDK has security vulnerabilties identified from the quay security scan.

Codeflare Stack Component Versions

Please specify the component versions in which you have encountered this bug.

Codeflare SDK: 0.9.0

Screenshots, Console Output, Logs, etc.
CVE | Severity | Package | Current version | Fixed in version
GHSA-jm77-qphf-c4w8 | Unknown | cryptography | 40.0.2 | 41.0.3
GHSA-5cpq-8wj7-hf2v | Unknown | cryptography | 40.0.2 | 41.0.0
GHSA-v8gr-m533-ghj9 | Unknown | cryptography | 40.0.2 | 41.0.4

Link to quay

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the dependency declaration that pins cryptography to 40.0.2; no file or test is named in the issue. Check the package's supported versions and update it to a version covering all listed fixes, then rerun the relevant image security scan to confirm the vulnerabilities are resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
cryptography, python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.