Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update deps to address vulnerability (#71)
#### Motivation Address high vulnerability Closes: https://issues.redhat.com/browse/RHOAIENG-4329 CVE info: https://www.cve.org/CVERecord?id=CVE-2024-27318 and https://www.cve.org/CVERecord?id=CVE-2024-27319 From SNYK report: Detailed paths Introduced through: text-generation-server@0.1.0 › onnx@1.15.0 Introduced through: text-generation-server@0.1.0 › optimum@1.17.1 › onnx@1.15.0 Security information Factors contributing to the scoring: Snyk: [CVSS 7.5](https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-6231769) - High Severity NVD: Not available. NVD has not yet published its analysis. [Why are the scores different? Learn how Snyk evaluates vulnerability scores](https://docs.snyk.io/features/fixing-and-prioritizing-issues/issue-management/severity-levels#understanding-snyks-vulnerability-analysis) Overview [onnx](https://pypi.org/project/onnx) is an Open Neural Network Exchange Affected versions of this package are vulnerable to Directory Traversal due to unsafe path manipulation in external_data_helper.py. An attacker can traverse up the directory tree from a base path to expose files outside the intended working directory. This is a bypass for the previously reported [CVE-2022-25882](https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479). [Describe why this change is needed] #### Modifications [Describe the code changes] #### Result [Describe how the changes affects existing behavior and how to test it] #### Related Issues [Resolves #123] Signed-off-by: heyselbi <selbi@redhat.com>
- Loading branch information