Skip to content

Commit

Permalink
Update deps to address vulnerability (#71)
Browse files Browse the repository at this point in the history
#### Motivation
Address high vulnerability
Closes: https://issues.redhat.com/browse/RHOAIENG-4329
CVE info: https://www.cve.org/CVERecord?id=CVE-2024-27318
and https://www.cve.org/CVERecord?id=CVE-2024-27319

From SNYK report:
Detailed paths
Introduced through: text-generation-server@0.1.0 › onnx@1.15.0
Introduced through: text-generation-server@0.1.0 › optimum@1.17.1 ›
onnx@1.15.0
Security information
Factors contributing to the scoring:
Snyk: [CVSS 7.5](https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-6231769)
- High Severity

NVD: Not available. NVD has not yet published its analysis.
[Why are the scores different? Learn how Snyk evaluates vulnerability
scores](https://docs.snyk.io/features/fixing-and-prioritizing-issues/issue-management/severity-levels#understanding-snyks-vulnerability-analysis)
Overview
[onnx](https://pypi.org/project/onnx) is an Open Neural Network Exchange

Affected versions of this package are vulnerable to Directory Traversal
due to unsafe path manipulation in external_data_helper.py. An attacker
can traverse up the directory tree from a base path to expose files
outside the intended working directory. This is a bypass for the
previously reported
[CVE-2022-25882](https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479).

[Describe why this change is needed]

#### Modifications

[Describe the code changes]

#### Result

[Describe how the changes affects existing behavior and how to test it]

#### Related Issues

[Resolves #123]

Signed-off-by: heyselbi <selbi@redhat.com>
  • Loading branch information
heyselbi authored Mar 27, 2024
1 parent 545bbf6 commit bcae363
Show file tree
Hide file tree
Showing 2 changed files with 1,985 additions and 1,778 deletions.
Loading

0 comments on commit bcae363

Please sign in to comment.