Fix vulnerabilities - Githubissues

ckunki commented 2 months ago

This release fixes the following vulnerabilities by updating dependencies:

Vulnerability CVE-2024-23342 in transitive dependency via localstack to ecdsa.
Vulnerability CVE-2024-5206 in dependency scikit-learn versions below 1.5.0 caused by sensitive data leakage.
- Please note: Users may need to install a different version anyway in order to match the version of the built-in SLC used in the Exasol database, see ticket #313.
Vulnerability CVE-2024-37891 in transitive dependency via boto3 to urllib3 in versions below 2.2.2 caused by proxy-authorization request header not to be stripped during cross-origin redirects.
Vulnerability CVE-2024-35195 in dependency requests in versions below 2.32.0 caused by requests Session object not verifying requests after making first request with verify=False.

The release ignores the following vulnerabilities

Vulnerability CVE-2024-33663 in transitive dependency via localstack to python-jose 3.3.0 caused by algorithm confusion with OpenSSH ECDSA keys as there is no newer version of python-jose available and the dependency only affects tests.

ckunki commented 2 months ago

ckunki commented 1 month ago

Blocked until releases of TE and SME are published to pypi

exasol / ai-lab