This release fixes the following vulnerabilities by updating dependencies:
Vulnerability CVE-2024-23342 in transitive dependency via localstack to ecdsa.
Vulnerability CVE-2024-5206 in dependency scikit-learn versions below 1.5.0 caused by sensitive data leakage.
Please note: Users may need to install a different version anyway in order to match the version of the built-in SLC used in the Exasol database, see ticket #313.
Vulnerability CVE-2024-37891 in transitive dependency via boto3 to urllib3 in versions below 2.2.2 caused by proxy-authorization request header not to be stripped during cross-origin redirects.
Vulnerability CVE-2024-35195 in dependency requests in versions below 2.32.0 caused by requests Session object not verifying requests after making first request with verify=False.
The release ignores the following vulnerabilities
Vulnerability CVE-2024-33663 in transitive dependency via localstack to python-jose3.3.0 caused by algorithm confusion with OpenSSH ECDSA keys as there is no newer version of python-jose available and the dependency only affects tests.
This release fixes the following vulnerabilities by updating dependencies:
scikit-learn
versions below1.5.0
caused by sensitive data leakage.boto3
tourllib3
in versions below2.2.2
caused by proxy-authorization request header not to be stripped during cross-origin redirects.requests
in versions below2.32.0
caused by requestsSession
object not verifying requests after making first request withverify=False
.The release ignores the following vulnerabilities
localstack
topython-jose
3.3.0
caused by algorithm confusion with OpenSSH ECDSA keys as there is no newer version ofpython-jose
available and the dependency only affects tests.