[Snyk] Security upgrade python from 3.11-slim to 3.13.0b2-slim #287

Closed

luketainton wants to merge 1 commits from snyk-fix-1c12db40d5fe3626bcb63116f2214b12 into main

pull from: snyk-fix-1c12db40d5fe3626bcb63116f2214b12

merge into: repos:main

Conversation 1 Commits 1 Files Changed 1 +1 -1

luketainton commented 2024-07-04 09:29:26 +02:00 (Migrated from github.com)

Copy Link

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• Dockerfile

We recommend upgrading to python:3.13.0b2-slim, as this image has only 43 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Integer Overflow or Wraparound SNYK-DEBIAN12-ZLIB-6008963	264
	Out-of-Bounds SNYK-DEBIAN12-GLIBC-1547196	182
	Out-of-Bounds SNYK-DEBIAN12-GLIBC-1547196	182
	CVE-2005-2541 SNYK-DEBIAN12-TAR-1560620	182
	Improper Certificate Validation SNYK-DEBIAN12-PERL-5489184	167

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

<p>This PR was automatically created by Snyk using the credentials of a real user.</p><br /> ### Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project. Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image. #### Snyk changed the following file(s): - `Dockerfile` We recommend upgrading to `python:3.13.0b2-slim`, as this image has only **43** known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected. #### Vulnerabilities that will be fixed with an upgrade: | | Issue | Score | :-------------------------:|:-------------------------|:-------------------------  | Integer Overflow or Wraparound <br/>[SNYK-DEBIAN12-ZLIB-6008963](https://snyk.io/vuln/SNYK-DEBIAN12-ZLIB-6008963) | &nbsp;&nbsp;**264**&nbsp;&nbsp;  | Out-of-Bounds <br/>[SNYK-DEBIAN12-GLIBC-1547196](https://snyk.io/vuln/SNYK-DEBIAN12-GLIBC-1547196) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | Out-of-Bounds <br/>[SNYK-DEBIAN12-GLIBC-1547196](https://snyk.io/vuln/SNYK-DEBIAN12-GLIBC-1547196) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | CVE-2005-2541 <br/>[SNYK-DEBIAN12-TAR-1560620](https://snyk.io/vuln/SNYK-DEBIAN12-TAR-1560620) | &nbsp;&nbsp;**182**&nbsp;&nbsp;  | Improper Certificate Validation <br/>[SNYK-DEBIAN12-PERL-5489184](https://snyk.io/vuln/SNYK-DEBIAN12-PERL-5489184) | &nbsp;&nbsp;**167**&nbsp;&nbsp; --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - Max score is 1000. Note that the real score may have changed since the PR was raised. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._ For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJkZDMyNDk1MC1jNmRiLTRkODUtYjZlMC0wNjM5ZDA4NGUzNGMiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImRkMzI0OTUwLWM2ZGItNGQ4NS1iNmUwLTA2MzlkMDg0ZTM0YyJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/luketainton/project/a27f4370-414e-444d-82a0-f8e1cde3805a?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr) 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates) 🛠 [Adjust project settings](https://app.snyk.io/org/luketainton/project/a27f4370-414e-444d-82a0-f8e1cde3805a?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings) 📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc&#x3D;fix-pr) [//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"python","from":"3.11-slim","to":"3.13.0b2-slim"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-ZLIB-6008963","priority_score":264,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00121},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Thu Oct 19 2023 04:21:02 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"critical"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":9.79},{"name":"likelihood","value":2.69},{"name":"scoreVersion","value":"V5"}],"severity":"critical","title":"Integer Overflow or Wraparound"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-GLIBC-1547196","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00335},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Jul 24 2019 09:33:32 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.99},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Out-of-Bounds"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-GLIBC-1547196","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00335},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Jul 24 2019 09:33:32 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.99},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Out-of-Bounds"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-TAR-1560620","priority_score":182,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00634},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Wed Aug 10 2005 04:00:00 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":3},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"CVE-2005-2541"},{"exploit_maturity":"No Known Exploit","id":"SNYK-DEBIAN12-PERL-5489184","priority_score":167,"priority_score_factors":[{"name":"confidentiality","value":"high"},{"name":"integrity","value":"high"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"high"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00286},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Sat Apr 29 2023 12:53:47 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"low"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":6.06},{"name":"likelihood","value":2.75},{"name":"scoreVersion","value":"V5"}],"severity":"low","title":"Improper Certificate Validation"}],"prId":"dd324950-c6db-4d85-b6e0-0639d084e34c","prPublicId":"dd324950-c6db-4d85-b6e0-0639d084e34c","packageManager":"dockerfile","priorityScoreList":[264,182,182,167],"projectPublicId":"a27f4370-414e-444d-82a0-f8e1cde3805a","projectUrl":"https://app.snyk.io/org/luketainton/project/a27f4370-414e-444d-82a0-f8e1cde3805a?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-PERL-5489184","SNYK-DEBIAN12-TAR-1560620","SNYK-DEBIAN12-ZLIB-6008963"],"vulns":["SNYK-DEBIAN12-ZLIB-6008963","SNYK-DEBIAN12-GLIBC-1547196","SNYK-DEBIAN12-TAR-1560620","SNYK-DEBIAN12-PERL-5489184"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

sonarqubecloud[bot] commented 2024-07-04 09:30:37 +02:00 (Migrated from github.com)

Copy Link

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

## [](https://sonarcloud.io/dashboard?id=luketainton_webexmemebot&pullRequest=287) **Quality Gate passed** Issues  [0 New issues](https://sonarcloud.io/project/issues?id=luketainton_webexmemebot&pullRequest=287&resolved=false&sinceLeakPeriod=true)  [0 Accepted issues](https://sonarcloud.io/project/issues?id=luketainton_webexmemebot&pullRequest=287&resolutions=WONTFIX) Measures  [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=luketainton_webexmemebot&pullRequest=287&resolved=false&sinceLeakPeriod=true)  [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=luketainton_webexmemebot&pullRequest=287&metric=new_coverage&view=list)  [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=luketainton_webexmemebot&pullRequest=287&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=luketainton_webexmemebot&pullRequest=287)

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

blocked

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

linting

question

Further information is requested

security

type

bugfix

type

dependencies

type

feature

type

other

unit-tests

wontfix

This will not be worked on

Compat/Breaking

Breaking change that won't be backward compatible

Kind/Bug

Something is not working

Kind/Documentation

Documentation changes

Kind/Enhancement

Improve existing functionality

Kind/Feature

New functionality

Kind/Security

This is security issue

Kind/Testing

Issue or pull request related to testing

Priority

Critical

The priority is critical

Priority

High

The priority is high

Priority

Low

The priority is low

Priority

Medium

The priority is medium

Reviewed

Confirmed

Issue has been confirmed

Reviewed

Duplicate

This issue or pull request already exists

Reviewed

Invalid

Invalid issue

Reviewed

Won't Fix

This issue won't be fixed

Status

Abandoned

Somebody has started to work on this but abandoned work

Status

Blocked

Something is blocking this issue or pull request

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No Label

blocked

Milestone

No items

No Milestone

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: repos/webexmemebot#287

No description provided.