Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade starlette from 0.22.0 to 0.27.0 #35

Closed
wants to merge 2 commits into from
Closed

[Snyk] Security upgrade starlette from 0.22.0 to 0.27.0 #35

wants to merge 2 commits into from

Commits on Dec 5, 2023

  1. fixes critical vulnerabiolities on ray 

    chore: 	fix the following CVEs
	- [CVE-2023-6019](https://www.cve.org/CVERecord?id=CVE-2023-6019): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
	- [CVE-2023-6020](https://www.cve.org/CVERecord?id=CVE-2023-6020): Use of GET Request Method With Sensitive Query Strings

There are no fix for [CVE-2023-48023](https://www.cve.org/CVERecord?id=CVE-2023-48023) yet

Signed-off-by: Spolti <fspolti@redhat.com>
    @spolti
    spolti committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    7af939f View commit details
    Browse the repository at this point in the history

Commits on Dec 14, 2023

  1. fix: docs/samples/v1beta1/xgboost/requirements.txt to reduce vulnerab… 

    …ilities

The following vulnerabilities are fixed by pinning transitive dependencies:
- https://snyk.io/vuln/SNYK-PYTHON-STARLETTE-3319937
- https://snyk.io/vuln/SNYK-PYTHON-STARLETTE-5538332
    @snyk-bot
    snyk-bot committed Dec 14, 2023
    Configuration menu
    Copy the full SHA
    3a67558 View commit details
    Browse the repository at this point in the history