[Snyk] Security upgrade python from 3.11-slim to 3.13.0b2-slim #238

Closed

luketainton wants to merge 3 commits from snyk-fix-4bb5414255ab6a79b6697d6e1969ccff into main

pull from: snyk-fix-4bb5414255ab6a79b6697d6e1969ccff

merge into: public:main

public:main

public:snyk-fix-08443f90f1baff7a411c8037496275df

public:snyk-fix-0dc4aaeb9564aba8e592c95867fe548e

Conversation 4 Commits 3 Files Changed 1 +1 -1

luketainton commented 2024-07-04 09:30:27 +02:00 (Migrated from github.com)

Copy Link

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• Dockerfile

We recommend upgrading to python:3.13.0b2-slim, as this image has only 43 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Integer Overflow or Wraparound SNYK-DEBIAN12-ZLIB-6008963	264
	Out-of-Bounds SNYK-DEBIAN12-GLIBC-1547196	182
	Out-of-Bounds SNYK-DEBIAN12-GLIBC-1547196	182
	CVE-2005-2541 SNYK-DEBIAN12-TAR-1560620	182
	Improper Certificate Validation SNYK-DEBIAN12-PERL-5489184	167

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

<p>This PR was automatically created by Snyk using the credentials of a real user.</p><br /> ### Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project. Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image. #### Snyk changed the following file(s): - `Dockerfile` We recommend upgrading to `python:3.13.0b2-slim`, as this image has only **43** known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected. #### Vulnerabilities that will be fixed with an upgrade: | | Issue | Score | :-------------------------:|:-------------------------|:-------------------------  | Integer Overflow or Wraparound <br/>[SNYK-DEBIAN12-ZLIB-6008963](https://snyk.io/vuln/SNYK-DEBIAN12-ZLIB-6008963) | &nbsp;&nbsp;**264**&nbsp;&nbsp;  | Out-of-Bounds <br/>[SNYK-DEBIAN12-GLIBC-1547196](https://snyk.io/vuln/SNYK-DEBIAN12-GLIBC-1547196) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | Out-of-Bounds <br/>[SNYK-DEBIAN12-GLIBC-1547196](https://snyk.io/vuln/SNYK-DEBIAN12-GLIBC-1547196) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | CVE-2005-2541 <br/>[SNYK-DEBIAN12-TAR-1560620](https://snyk.io/vuln/SNYK-DEBIAN12-TAR-1560620) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | Improper Certificate Validation <br/>[SNYK-DEBIAN12-PERL-5489184](https://snyk.io/vuln/SNYK-DEBIAN12-PERL-5489184) | &nbsp;&nbsp;**167**&nbsp;&nbsp; --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - Max score is 1000. Note that the real score may have changed since the PR was raised. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._ For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJlYWMwMThiYi1lZGRkLTRhNmEtOTQxYi00ZjVlZmNlMzNmMjIiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImVhYzAxOGJiLWVkZGQtNGE2YS05NDFiLTRmNWVmY2UzM2YyMiJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/luketainton/project/bb2acb95-6cb0-453b-8345-ae0e1c4cc3fb?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr) 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates) 🛠 [Adjust project settings](https://app.snyk.io/org/luketainton/project/bb2acb95-6cb0-453b-8345-ae0e1c4cc3fb?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings) 📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc&#x3D;fix-pr) [//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"python","from":"3.11-slim","to":"3.13.0b2-slim"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-ZLIB-6008963","priority_score":264,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00121},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Thu Oct 19 2023 04:21:02 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"critical"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":9.79},{"name":"likelihood","value":2.69},{"name":"scoreVersion","value":"V5"}],"severity":"critical","title":"Integer Overflow or Wraparound"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-TAR-1560620","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00634},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Aug 10 2005 04:00:00 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":3},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"CVE-2005-2541"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-GLIBC-1547196","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00335},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Jul 24 2019 09:33:32 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.99},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Out-of-Bounds"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-GLIBC-1547196","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00335},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Jul 24 2019 09:33:32 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.99},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Out-of-Bounds"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-PERL-5489184","priority_score":167,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"high"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00286},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Sat Apr 29 2023 12:53:47 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.75},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Improper Certificate Validation"}],"prId":"eac018bb-eddd-4a6a-941b-4f5efce33f22","prPublicId":"eac018bb-eddd-4a6a-941b-4f5efce33f22","packageManager":"dockerfile","priorityScoreList":[264,182,182,167],"projectPublicId":"bb2acb95-6cb0-453b-8345-ae0e1c4cc3fb","projectUrl":"https://app.snyk.io/org/luketainton/project/bb2acb95-6cb0-453b-8345-ae0e1c4cc3fb?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-PERL-5489184","SNYK-DEBIAN12-TAR-1560620","SNYK-DEBIAN12-ZLIB-6008963"],"vulns":["SNYK-DEBIAN12-ZLIB-6008963","SNYK-DEBIAN12-TAR-1560620","SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-PERL-5489184"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

sonarqubecloud[bot] commented 2024-07-04 09:31:29 +02:00 (Migrated from github.com)

Copy Link

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

## [](https://sonarcloud.io/dashboard?id=luketainton_roboluke-tasks&pullRequest=238) **Quality Gate passed** Issues  [0 New issues](https://sonarcloud.io/project/issues?id=luketainton_roboluke-tasks&pullRequest=238&resolved=false&sinceLeakPeriod=true)  [0 Accepted issues](https://sonarcloud.io/project/issues?id=luketainton_roboluke-tasks&pullRequest=238&resolutions=WONTFIX) Measures  [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=luketainton_roboluke-tasks&pullRequest=238&resolved=false&sinceLeakPeriod=true)  [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=luketainton_roboluke-tasks&pullRequest=238&metric=new_coverage&view=list)  [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=luketainton_roboluke-tasks&pullRequest=238&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=luketainton_roboluke-tasks&pullRequest=238)

sonarqubecloud[bot] commented 2024-08-27 23:43:00 +02:00 (Migrated from github.com)

Copy Link

Quality Gate failed

Failed conditions
D Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

## [](https://sonarcloud.io/dashboard?id=luketainton_roboluke-tasks&pullRequest=238) **Quality Gate failed** Failed conditions  [D Maintainability Rating on New Code](https://sonarcloud.io/dashboard?id=luketainton_roboluke-tasks&pullRequest=238) (required ≥ A) [See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=luketainton_roboluke-tasks&pullRequest=238) ##  Catch issues before they fail your Quality Gate with our IDE extension  [SonarLint](https://www.sonarsource.com/products/sonarlint/features/connected-mode/?referrer=pull-request)

luketainton commented 2024-08-27 23:44:20 +02:00 (Migrated from github.com)

Copy Link

Google Gemini AI Review

Decision: Reject
Change Score: 0%

This commit changes the base image of the Dockerfile from python:3.11-slim to python:3.13.0b2-slim. However, using beta or pre-release software in production can be risky and unstable.

Recommendation:
Change the base image back to a stable release, such as python:3.11-slim.

*Google Gemini AI Review* **Decision: Reject** **Change Score: 0%** This commit changes the base image of the Dockerfile from `python:3.11-slim` to `python:3.13.0b2-slim`. However, using beta or pre-release software in production can be risky and unstable. **Recommendation:** Change the base image back to a stable release, such as `python:3.11-slim`.

sonarqubecloud[bot] commented 2024-11-28 22:21:48 +01:00 (Migrated from github.com)

Copy Link

Quality Gate failed

Failed conditions
1 Security Hotspot
D Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

## [](https://sonarcloud.io/dashboard?id=luketainton_roboluke-tasks&pullRequest=238) **Quality Gate failed** Failed conditions  [1 Security Hotspot](https://sonarcloud.io/project/security_hotspots?id=luketainton_roboluke-tasks&pullRequest=238&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [D Maintainability Rating on New Code](https://sonarcloud.io/dashboard?id=luketainton_roboluke-tasks&pullRequest=238) (required ≥ A) [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=luketainton_roboluke-tasks&pullRequest=238) ##  Catch issues before they fail your Quality Gate with our IDE extension  [SonarQube for IDE](https://www.sonarsource.com/products/sonarlint/features/connected-mode/?referrer=pull-request)

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something isn't working

  

dependencies

Pull requests that update a dependency file

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

security

  

wontfix

This will not be worked on

No Label

bug

dependencies

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

security

wontfix

Milestone

Clear milestone

No items

No Milestone

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: public/roboluke-tasks#238

No description provided.