Open nickumia-reisys opened 1 year ago
There is a better chance that we'll be able to patch this vulnerability if we are on CKAN 2.10.0 (but there may still be issues).
See efforts to upgrade in the following two PRs:
Adding a March milestone to this so that we will look at it again, but given the discussion today at sync this seems like it has to await the CKAN 2.10 update which is #4209
Blocked by CKAN releasing compatibility changes to core code. See PR for details:
Conversation with CKAN core team on release schedule. No new developments, but at least they are aware that we are awaiting these fixes.
followed up with CKAN
_Please keep any sensitive details in Google Drive._
Date of report: 02/15/2023 Severity: High Due date: 03/15/2023
Due date is based on severity and described in RA-5. 15-days for Critical, 30-days for High, and 90-days for Moderate and lower.
Brief description
From our automated snyk scans, the above vulnerability in the
werkzeug
package was highlighted. After an investigation, it seems like there is no path forward to patch it. The upgrade ofwerkzeug
cascades into a bunch of breaking versions withFlask
andJinja2
and other packages. There is an open issue about running CKAN with the latest version ofFlask
and the patch release ofCKAN 2.9.8
still referencesFlask==1.1.1
.There is an open ticket in upstream CKAN that talk about the work related to this upgrade
There was an old patch that was completed in 11/2022, but Snyk says that the new vulnerability requires a newer release,
Other list of references: