project-codeflare / project-codeflare/codeflare-sdk
Security vulnerability in cryptography package
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 35
- Forks
- 66
- Avg merge
- 48m
- Merged PRs (30d)
- 7
Description
Describe the Bug
The cryptography package v40.0.2 imported in Codeflare SDK has security vulnerabilties identified from the quay security scan.
Codeflare Stack Component Versions
Please specify the component versions in which you have encountered this bug.
Codeflare SDK: 0.9.0
Screenshots, Console Output, Logs, etc.
CVE | Severity | Package | Current version | Fixed in version
GHSA-jm77-qphf-c4w8 | Unknown | cryptography | 40.0.2 | 41.0.3
GHSA-5cpq-8wj7-hf2v | Unknown | cryptography | 40.0.2 | 41.0.0
GHSA-v8gr-m533-ghj9 | Unknown | cryptography | 40.0.2 | 41.0.4
Link to quay
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the dependency declaration that pins cryptography to 40.0.2; no file or test is named in the issue. Check the package's supported versions and update it to a version covering all listed fixes, then rerun the relevant image security scan to confirm the vulnerabilities are resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cryptography, python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100