Comments (2)
Hi. Most of the triggers listed in attached files are related to various packages that are not directly involved with the service itself (like vim
). We'll probably switch to more lightweight base images with fewer dependencies in the future.
We are regularly analyse our dependencies, but we'll take a thorough look at your listing too, in case there is really something that can be exploited.
P.S. Just in case if you'll want to report some confirmed security problem in the future, please take a look at SECURITY.md
from datalens.
The pull request describes what has been updated datalens-tech/datalens-backend#48 if needed.
Reports are the attached. These files contain scan results for the new images. There remain two vulnerabilities marked as high risk:
- one does not affect us at all, because we do not use the vulnerable part of the library
- the second can cause file parser fail in some situations, we'll look into it later
snyk-data-api-report.txt
snyk-control-api-report.txt
All vulnerabilities, including these two, which we can still correct (i.e., those that did not come with the base image of Ubuntu and somehow affect us), are additionally described below and why we did not update immediately
Upgrade [email protected] to [email protected] to fix ✗ Missing Cryptographic Step (new) [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6036192] in [email protected] == Not vulnerable, will update later
Upgrade [email protected] to [email protected] to fix ✗ Information Exposure [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-REQUESTS-5595532] in [email protected] == Not vulnerable, will update later
Upgrade [email protected] to [email protected] to fix ✗ Double Free [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-UJSON-2940619] in [email protected] ✗ Improper Handling of Syntactically Invalid Structure [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-UJSON-2942122] in [email protected] ✗ Out-of-Bounds Write [High Severity][https://security.snyk.io/vuln/SNYK-PYTHON-UJSON-2359034] in [email protected] == Breaks current behavior, need to consider, the vulnerability does not affect users.
Upgrade [email protected] to [email protected] to fix ✗ Inefficient Algorithmic Complexity (new) [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-WERKZEUG-6035177] in [email protected] ✗ Denial of Service (DoS) (new) [High Severity][https://security.snyk.io/vuln/SNYK-PYTHON-WERKZEUG-6041510] in [email protected] == Not vulnerable
Pin [email protected] to [email protected] to fix ✗ Information Exposure Through Sent Data [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-URLLIB3-5926907] in [email protected] ✗ Information Exposure Through Sent Data (new) [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-URLLIB3-6002459] in [email protected] == Seems not vulnerable, medium, potentially breaking changes, will update later
from datalens.
Related Issues (20)
- Authorization / Object ACLs HOT 3
- Trash bin
- Improve visualisations in D3
- Add background option for Text Element HOT 1
- Add formulas to work with Clickhouse Dictionaries HOT 1
- Dicts in ClickHouse
- Additional languages support
- Use only IPv4 HOT 2
- Serving datalens ui under subpaths HOT 3
- SSL: WRONG_VERSION_NUMBER HOT 2
- demo data for docker-compose.yml as an option HOT 2
- nginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission denied) HOT 4
- Ability enable linear indicator for any column type
- Hint markup element and table column hint HOT 4
- Add please Arrow flight SQL driver
- Memory limit (total) exceeded in Dataset preview HOT 2
- Permission denied: '/etc/backend-configs/api.yaml'\ n", "lineno": 284 in datalens-data-api and datalens-control-api
- Hint markup function
- Private Charts Embedding
- User Authentication / Identity providers HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from datalens.