Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerability patch in hub #3506

Closed
wants to merge 1 commit into from
Closed

Vulnerability patch in hub #3506

wants to merge 1 commit into from

Conversation

jupyterhub-bot
Copy link
Collaborator

A rebuild of quay.io/jupyterhub/k8s-hub has been found to influence the detected vulnerabilities! This PR will trigger a rebuild because it has updated a comment in the Dockerfile.

About

This scan for known vulnerabilities has been made by aquasecurity/trivy. Trivy was configured to filter the vulnerabilities with the following settings:

  • ignore-unfixed: true

Before

Before trying to rebuild the image, the following vulnerabilities was detected in quay.io/jupyterhub/k8s-hub:4.0.0-0.dev.git.6734.h09260346.

Target Vuln. ID Package Name Installed v. Fixed v.
debian CVE-2024-45490 libexpat1 2.5.0-1 2.5.0-1+deb12u1
debian CVE-2024-45491 libexpat1 2.5.0-1 2.5.0-1+deb12u1
debian CVE-2024-45492 libexpat1 2.5.0-1 2.5.0-1+deb12u1
node-pkg CVE-2024-38999 requirejs 2.3.6 2.3.7
python-pkg CVE-2024-6345 setuptools 65.5.1 70.0.0
python-pkg GHSA-h4gh-qq45-vh27 cryptography 43.0.0 43.0.1

After

Target Vuln. ID Package Name Installed v. Fixed v.
node-pkg CVE-2024-38999 requirejs 2.3.6 2.3.7
python-pkg CVE-2024-6345 setuptools 65.5.1 70.0.0
python-pkg GHSA-h4gh-qq45-vh27 cryptography 43.0.0 43.0.1

@jupyterhub-bot jupyterhub-bot added the image:rebuild-to-patch-vuln Image rebuild to patch a known external vulnerability label Sep 23, 2024
@consideRatio
Copy link
Member

I'll rebuild images soon

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
image:rebuild-to-patch-vuln Image rebuild to patch a known external vulnerability
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants