tl-its-umich-edu/my-learning-analytics

Vulnerability: CVE-2015-20107, Python

Closed this issue · 8 comments

lsloan commented

From vulnerabilities spreadsheet, based on Unizin analysis:

CVE ID Effective Severity Severity Impacted Image Vulnerable Package Remediated Package URL
CVE-2015-20107 CRITICAL CRITICAL gcr.io/unizin-core/myla:2022.01.01 python3.9/3.9.2-1 python3.9/MAXIMUM https://security-tracker.debian.org/tracker/CVE-2015-20107
jonespm commented

This issue is still open in Python https://bugs.python.org/issue24778

We aren't using the mailcap module. There is currently some work toward removing this module in 3.13, but it does look like there is a fix in one of the latest versions of 3.10 and there is a backport for the next security release of 3.9.

https://security-tracker.debian.org/tracker/CVE-2015-20107

MyLA is still running Python 3.8 and that should also get this release, but we may want to look to ugprading. I think we'll have to revisit this in the next release?

jennlove-um commented

The fix is in Python 3.10.6-1. Will update docker image to Python 3.10 and verify the OpenShift vulnerability report.

ssciolla commented

@lsloan, we discussed this in the meeting. This is how I would approach it.

  1. Look at each of the Python dependencies and see if 3.10 is explicitly supported. Make a list of any that are not.
  2. If the list is empty, or only a couple don't support it, update the Docker base image to 3.10 and do a PRT of the tool, checking logs for errors. If all is well, it's probably okay to update.

If many dependencies don't support 3.10, or there is a problem when trying it, we'll have to wait on a patch to 3.8 or 3.9, and we can inform stakeholders that is our plan.

  • 👍1
jonespm commented

I think if you switch the base image to 3.10-slim

And then login to the container and run pip check it should tell you if everything is good. You'll also need to update the Openshift Docker file. 3.10-slim is available there too. It hopefully should be noticeable if something isn't right.

lsloan commented

Building with python:3.10-slim produced a whole raft of errors. It occurred in the pip install step using requirements.txt. The problems began with installing numpy. Looks like it had downloaded the version we specify, 1.22, but some other dependency along the way tries to install 1.19.3. After that, we get a message about RuntimeWarning: NumPy 1.19.3 may not yet support Python 3.10..

So, installing the newer Python and running pip check isn't cutting it at the moment. I'll need to step back to examining each of the dependencies, as @ssciolla suggested.

lsloan commented

Looks like I'll need to update requirements.txt to use a newer version of pandas.

And google-cloud-bigquery[pandas], apparently.

pushyamig commented

I will QA this

pushyamig commented

Test passes

  1. Updated to Python version 3.10.7, pandas, numypy, pangres, google-cloud-bigquery[pandas] all updated to correct version
  2. cron ran successfully and did not see this warning UserWarning: pandas only support SQLAlchemy connectable(engine/connection) ordatabase string URI or sqlite3 DBAPI2 connectionother DBAPI2 objects are not tested, please consider using SQLAlchemy
  3. All the views load fine