[Snyk] Security upgrade python from 3.11-slim to 3.13.0b2-slim #287

Closed

luketainton wants to merge 1 commits from snyk-fix-1c12db40d5fe3626bcb63116f2214b12 into main

pull from: snyk-fix-1c12db40d5fe3626bcb63116f2214b12

merge into: public:main

public:main

Conversation 1 Commits 1 Files Changed 1 +1 -1

luketainton commented 2024-07-04 09:29:26 +02:00 (Migrated from github.com)

Copy Link

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• Dockerfile

We recommend upgrading to python:3.13.0b2-slim, as this image has only 43 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Integer Overflow or Wraparound SNYK-DEBIAN12-ZLIB-6008963	264
	Out-of-Bounds SNYK-DEBIAN12-GLIBC-1547196	182
	Out-of-Bounds SNYK-DEBIAN12-GLIBC-1547196	182
	CVE-2005-2541 SNYK-DEBIAN12-TAR-1560620	182
	Improper Certificate Validation SNYK-DEBIAN12-PERL-5489184	167

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

<p>This PR was automatically created by Snyk using the credentials of a real user.</p><br /> ### Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project. Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image. #### Snyk changed the following file(s): - `Dockerfile` We recommend upgrading to `python:3.13.0b2-slim`, as this image has only **43** known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected. #### Vulnerabilities that will be fixed with an upgrade: | | Issue | Score | :-------------------------:|:-------------------------|:-------------------------  | Integer Overflow or Wraparound <br/>[SNYK-DEBIAN12-ZLIB-6008963](https://snyk.io/vuln/SNYK-DEBIAN12-ZLIB-6008963) | &nbsp;&nbsp;**264**&nbsp;&nbsp;  | Out-of-Bounds <br/>[SNYK-DEBIAN12-GLIBC-1547196](https://snyk.io/vuln/SNYK-DEBIAN12-GLIBC-1547196) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | Out-of-Bounds <br/>[SNYK-DEBIAN12-GLIBC-1547196](https://snyk.io/vuln/SNYK-DEBIAN12-GLIBC-1547196) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | CVE-2005-2541 <br/>[SNYK-DEBIAN12-TAR-1560620](https://snyk.io/vuln/SNYK-DEBIAN12-TAR-1560620) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | Improper Certificate Validation <br/>[SNYK-DEBIAN12-PERL-5489184](https://snyk.io/vuln/SNYK-DEBIAN12-PERL-5489184) | &nbsp;&nbsp;**167**&nbsp;&nbsp; --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - Max score is 1000. Note that the real score may have changed since the PR was raised. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._ For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJkZDMyNDk1MC1jNmRiLTRkODUtYjZlMC0wNjM5ZDA4NGUzNGMiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImRkMzI0OTUwLWM2ZGItNGQ4NS1iNmUwLTA2MzlkMDg0ZTM0YyJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/luketainton/project/a27f4370-414e-444d-82a0-f8e1cde3805a?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr) 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates) 🛠 [Adjust project settings](https://app.snyk.io/org/luketainton/project/a27f4370-414e-444d-82a0-f8e1cde3805a?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings) 📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc&#x3D;fix-pr) [//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"python","from":"3.11-slim","to":"3.13.0b2-slim"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-ZLIB-6008963","priority_score":264,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00121},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Thu Oct 19 2023 04:21:02 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"critical"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":9.79},{"name":"likelihood","value":2.69},{"name":"scoreVersion","value":"V5"}],"severity":"critical","title":"Integer Overflow or Wraparound"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-GLIBC-1547196","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00335},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Jul 24 2019 09:33:32 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.99},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Out-of-Bounds"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-GLIBC-1547196","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00335},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Jul 24 2019 09:33:32 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.99},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Out-of-Bounds"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-TAR-1560620","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00634},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Aug 10 2005 04:00:00 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":3},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"CVE-2005-2541"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-PERL-5489184","priority_score":167,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"high"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00286},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Sat Apr 29 2023 12:53:47 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.75},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Improper Certificate Validation"}],"prId":"dd324950-c6db-4d85-b6e0-0639d084e34c","prPublicId":"dd324950-c6db-4d85-b6e0-0639d084e34c","packageManager":"dockerfile","priorityScoreList":[264,182,182,167],"projectPublicId":"a27f4370-414e-444d-82a0-f8e1cde3805a","projectUrl":"https://app.snyk.io/org/luketainton/project/a27f4370-414e-444d-82a0-f8e1cde3805a?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-PERL-5489184","SNYK-DEBIAN12-TAR-1560620","SNYK-DEBIAN12-ZLIB-6008963"],"vulns":["SNYK-DEBIAN12-ZLIB-6008963","SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-TAR-1560620","SNYK-DEBIAN12-PERL-5489184"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

sonarqubecloud[bot] commented 2024-07-04 09:30:37 +02:00 (Migrated from github.com)

Copy Link

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

## [](https://sonarcloud.io/dashboard?id=luketainton_webexmemebot&pullRequest=287) **Quality Gate passed** Issues  [0 New issues](https://sonarcloud.io/project/issues?id=luketainton_webexmemebot&pullRequest=287&resolved=false&sinceLeakPeriod=true)  [0 Accepted issues](https://sonarcloud.io/project/issues?id=luketainton_webexmemebot&pullRequest=287&resolutions=WONTFIX) Measures  [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=luketainton_webexmemebot&pullRequest=287&resolved=false&sinceLeakPeriod=true)  [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=luketainton_webexmemebot&pullRequest=287&metric=new_coverage&view=list)  [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=luketainton_webexmemebot&pullRequest=287&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=luketainton_webexmemebot&pullRequest=287)

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

blocked

  

bug

Something isn't working

  

dependencies

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

linting

  

question

Further information is requested

  

security

  

type

bugfix

  

type

dependencies

  

type

feature

  

type

other

  

unit-tests

  

wontfix

This will not be worked on

No Label

blocked

bug

dependencies

documentation

duplicate

enhancement

good first issue

help wanted

invalid

linting

question

security

type

bugfix

type

dependencies

type

feature

type

other

unit-tests

wontfix

Milestone

Clear milestone

No items

No Milestone

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: public/webexmemebot#287

No description provided.