Vulnerabilities found for jupyter-web-app:1.8


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.56/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.

charmedkubeflow/jupyter-web-app:1.8-2605035 (ubuntu 22.04)
==========================================================
Total: 0 (HIGH: 0, CRITICAL: 0)

Python (python-pkg)
===================
Total: 4 (HIGH: 3, CRITICAL: 1)

┌───────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│        Library        │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├───────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ Flask-Cors (METADATA) │ CVE-2024-6221  │ HIGH     │ fixed  │ 4.0.0             │ 4.0.2         │ A vulnerability in corydolphin/flask-cors version 4.0.1     │
│                       │                │          │        │                   │               │ allows the `Ac ...                                          │
│                       │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-6221                   │
├───────────────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ Werkzeug (METADATA)   │ CVE-2024-34069 │          │        │ 3.0.2             │ 3.0.3         │ python-werkzeug: user may execute code on a developer's     │
│                       │                │          │        │                   │               │ machine                                                     │
│                       │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-34069                  │
├───────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ gevent (METADATA)     │ CVE-2023-41419 │ CRITICAL │        │ 22.10.2           │ 23.9.0        │ python-gevent: privilege escalation via a crafted script to │
│                       │                │          │        │                   │               │ the WSGIServer component                                    │
│                       │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-41419                  │
├───────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ setuptools (METADATA) │ CVE-2024-6345  │ HIGH     │        │ 69.5.1            │ 70.0.0        │ pypa/setuptools: Remote code execution via download         │
│                       │                │          │        │                   │               │ functions in the package_index module in...                 │
│                       │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-6345                   │
└───────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
Details: https://github.com/canonical/kubeflow-rocks/actions/runs/11864733499
canonical / kubeflow-rocks

Vulnerabilities found for jupyter-web-app:1.8 #146

Vulnerabilities found for jupyter-web-app:1.8
