Latest vulnerability fixes #127
Conversation
1. Package ip had vulnerabilities. Upgrading node-alpine docker image to latest available version. This node image does not contain the ip package at all. Additionally, the latest ip version 2.0.1 might not contain the remediation as yet.
MukuFlash03
changed the title
Pillow version upgraded in viz_scripts/docker/environment36.dashboard.additions.yml.
|
This needs to be updated to be consistent with e-mission/nrel-openpath-join-page#30 |
|
@Abby-Wheelis for visibility into DevOps changes |
Bumped up latest server image used build from as base docker image.
|
Addressed review comments for related Node image used in join repo here. Added a commit to update Docker image tag to build from latest server image. |
| @@ -7,3 +7,5 @@ dependencies: | |||
| - pip: | |||
| - nbparameterise==0.6 | |||
| - devcron==0.4 | |||
| - pillow==10.3.0 | |||
There was a problem hiding this comment.
why are we adding pillow here?
There was no pillow before, so it should not have resulted in a CVE
There was a problem hiding this comment.
Right, I thought the same when fixing this but AWS listed pillow as a vulnerability in the viz_scripts container.
It's not a CVE though, its a SNYK-PYTHON category.
When I was last saw it, the Status column mentioned SUPPRESSED, while now it says CLOSED.
I've removed the pillow version added here.
Also, I've confirmed that for admin-dash container as well the vulnerability has been marked with status CLOSED.
|
@MukuFlash03 there are now whitespace changes in |
Initially, AWS mentioned it as a SUPPRESSED status vulnerability with HIGH severity. Hence I added it. However, we don't really use pillow in public-dash viz_scripts and now can observe that the pillow vulnerability status has been changed to CLOSED.
MukuFlash03
force-pushed
the
vuln-fix-apr24-2
branch
from
3d03bd0
to
9a9cf4c
Compare
Changes reverted correctly. To avoid this, fixed correctly by restoring the version of the file to its version before commit that changed it using a git command. |
|
@MukuFlash03 @nataliejschultz I am squash-merging the changes to avoid commit churn. Please take into account when pulling. |
Summary
Details about how this was handled present in this PR for join repo.
Details about how the first four vulnerabilties are handled present in this PR for e-mission-server repo.
Pillow fixed by updating package version manually in viz_scripts/docker/environment36.dashboard.additions.yml.