search

miracum / ahd2fhir

A REST service for mapping text analysis results from Averbis Health Discovery to FHIR resources.
Apache License 2.0
8 stars 0 forks source link

chore(deps): update dependency urllib3 to v2.2.2 [security] #175

Closed renovate[bot] closed 5 months ago

renovate[bot] commented 5 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
urllib3 (changelog) ==2.2.1 -> ==2.2.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-37891

When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected.

However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the Proxy-Authorization header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the Proxy-Authorization HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.

Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the Proxy-Authorization header during cross-origin redirects to avoid the small chance that users are doing this on accident.

Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the Proxy-Authorization header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach.

Affected usages

We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:

Remediation

Release Notes

urllib3/urllib3 (urllib3) ### [`v2.2.2`](https://togithub.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#222-2024-06-17) [Compare Source](https://togithub.com/urllib3/urllib3/compare/2.2.1...2.2.2) \================== - Added the `Proxy-Authorization` header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via `Retry.remove_headers_on_redirect`. - Allowed passing negative integers as `amt` to read methods of `http.client.HTTPResponse` as an alternative to `None`. (`#​3122 `\__) - Fixed return types representing copying actions to use `typing.Self`. (`#​3363 `\__)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

github-actions[bot] commented 5 months ago

Trivy image scan report

ghcr.io/miracum/ahd2fhir:pr-175 (debian 12.5)

72 known vulnerabilities found (CRITICAL: 1 HIGH: 18 MEDIUM: 32 LOW: 21)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
libc6 CVE-2024-2961 HIGH 2.36-9+deb12u4 2.36-9+deb12u6
libc6 CVE-2024-33599 HIGH 2.36-9+deb12u4 2.36-9+deb12u7
libc6 CVE-2024-33600 MEDIUM 2.36-9+deb12u4 2.36-9+deb12u7
libc6 CVE-2024-33601 MEDIUM 2.36-9+deb12u4 2.36-9+deb12u7
libc6 CVE-2024-33602 MEDIUM 2.36-9+deb12u4 2.36-9+deb12u7
libc6 CVE-2010-4756 LOW 2.36-9+deb12u4
libc6 CVE-2018-20796 LOW 2.36-9+deb12u4
libc6 CVE-2019-1010022 LOW 2.36-9+deb12u4
libc6 CVE-2019-1010023 LOW 2.36-9+deb12u4
libc6 CVE-2019-1010024 LOW 2.36-9+deb12u4
libc6 CVE-2019-1010025 LOW 2.36-9+deb12u4
libc6 CVE-2019-9192 LOW 2.36-9+deb12u4
libexpat1 CVE-2023-52425 HIGH 2.5.0-1
libexpat1 CVE-2023-52426 LOW 2.5.0-1
libexpat1 CVE-2024-28757 LOW 2.5.0-1
libgcc-s1 CVE-2023-4039 MEDIUM 12.2.0-14
libgcc-s1 CVE-2022-27943 LOW 12.2.0-14
libgomp1 CVE-2023-4039 MEDIUM 12.2.0-14
libgomp1 CVE-2022-27943 LOW 12.2.0-14
libgssapi-krb5-2 CVE-2024-26462 HIGH 1.20.1-2+deb12u1
libgssapi-krb5-2 CVE-2024-26458 MEDIUM 1.20.1-2+deb12u1
libgssapi-krb5-2 CVE-2024-26461 MEDIUM 1.20.1-2+deb12u1
libgssapi-krb5-2 CVE-2018-5709 LOW 1.20.1-2+deb12u1
libk5crypto3 CVE-2024-26462 HIGH 1.20.1-2+deb12u1
libk5crypto3 CVE-2024-26458 MEDIUM 1.20.1-2+deb12u1
libk5crypto3 CVE-2024-26461 MEDIUM 1.20.1-2+deb12u1
libk5crypto3 CVE-2018-5709 LOW 1.20.1-2+deb12u1
libkrb5-3 CVE-2024-26462 HIGH 1.20.1-2+deb12u1
libkrb5-3 CVE-2024-26458 MEDIUM 1.20.1-2+deb12u1
libkrb5-3 CVE-2024-26461 MEDIUM 1.20.1-2+deb12u1
libkrb5-3 CVE-2018-5709 LOW 1.20.1-2+deb12u1
libkrb5support0 CVE-2024-26462 HIGH 1.20.1-2+deb12u1
libkrb5support0 CVE-2024-26458 MEDIUM 1.20.1-2+deb12u1
libkrb5support0 CVE-2024-26461 MEDIUM 1.20.1-2+deb12u1
libkrb5support0 CVE-2018-5709 LOW 1.20.1-2+deb12u1
libncursesw6 CVE-2023-50495 MEDIUM 6.4-4
libncursesw6 CVE-2023-45918 LOW 6.4-4
libpython3.11-minimal CVE-2023-24329 HIGH 3.11.2-6
libpython3.11-minimal CVE-2023-41105 HIGH 3.11.2-6
libpython3.11-minimal CVE-2023-6597 HIGH 3.11.2-6
libpython3.11-minimal CVE-2023-27043 MEDIUM 3.11.2-6
libpython3.11-minimal CVE-2023-40217 MEDIUM 3.11.2-6
libpython3.11-minimal CVE-2024-0450 MEDIUM 3.11.2-6
libpython3.11-stdlib CVE-2023-24329 HIGH 3.11.2-6
libpython3.11-stdlib CVE-2023-41105 HIGH 3.11.2-6
libpython3.11-stdlib CVE-2023-6597 HIGH 3.11.2-6
libpython3.11-stdlib CVE-2023-27043 MEDIUM 3.11.2-6
libpython3.11-stdlib CVE-2023-40217 MEDIUM 3.11.2-6
libpython3.11-stdlib CVE-2024-0450 MEDIUM 3.11.2-6
libsqlite3-0 CVE-2023-7104 HIGH 3.40.1-2
libsqlite3-0 CVE-2024-0232 MEDIUM 3.40.1-2
libsqlite3-0 CVE-2021-45346 LOW 3.40.1-2
libssl3 CVE-2023-5678 MEDIUM 3.0.11-1~deb12u2
libssl3 CVE-2023-6129 MEDIUM 3.0.11-1~deb12u2
libssl3 CVE-2023-6237 MEDIUM 3.0.11-1~deb12u2
libssl3 CVE-2024-0727 MEDIUM 3.0.11-1~deb12u2
libssl3 CVE-2024-4603 MEDIUM 3.0.11-1~deb12u2
libssl3 CVE-2024-4741 MEDIUM 3.0.11-1~deb12u2
libssl3 CVE-2024-2511 LOW 3.0.11-1~deb12u2
libstdc++6 CVE-2023-4039 MEDIUM 12.2.0-14
libstdc++6 CVE-2022-27943 LOW 12.2.0-14
libtinfo6 CVE-2023-50495 MEDIUM 6.4-4
libtinfo6 CVE-2023-45918 LOW 6.4-4
libuuid1 CVE-2024-28085 HIGH 2.38.1-5+b1 2.38.1-5+deb12u1
libuuid1 CVE-2022-0563 LOW 2.38.1-5+b1
python3.11-minimal CVE-2023-24329 HIGH 3.11.2-6
python3.11-minimal CVE-2023-41105 HIGH 3.11.2-6
python3.11-minimal CVE-2023-6597 HIGH 3.11.2-6
python3.11-minimal CVE-2023-27043 MEDIUM 3.11.2-6
python3.11-minimal CVE-2023-40217 MEDIUM 3.11.2-6
python3.11-minimal CVE-2024-0450 MEDIUM 3.11.2-6
zlib1g CVE-2023-45853 CRITICAL 1:1.2.13.dfsg-1

No Misconfigurations found

Python

1 known vulnerabilities found (CRITICAL: 0 HIGH: 0 MEDIUM: 1 LOW: 0)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
requests CVE-2024-35195 MEDIUM 2.31.0 2.32.0

No Misconfigurations found

github-actions[bot] commented 5 months ago

🦙 MegaLinter status: ❌ ERROR

Descriptor Linter Files Fixed Errors Elapsed time
✅ ACTION actionlint 5 0 0.06s
✅ BASH bash-exec 2 0 0.06s
✅ BASH shellcheck 2 0 0.03s
✅ BASH shfmt 2 0 0.01s
✅ DOCKERFILE hadolint 2 0 0.19s
✅ JSON jsonlint 17 0 0.67s
✅ JSON npm-package-json-lint yes no 1.14s
✅ JSON prettier 17 0 1.8s
✅ MARKDOWN markdownlint 3 0 0.69s
✅ PYTHON bandit 31 0 2.23s
✅ PYTHON black 31 0 2.5s
✅ PYTHON flake8 31 0 1.48s
✅ PYTHON isort 31 0 0.42s
✅ PYTHON mypy 31 0 9.76s
✅ PYTHON pyright 31 0 9.39s
✅ PYTHON ruff 31 0 0.08s
✅ REPOSITORY checkov yes no 15.68s
✅ REPOSITORY gitleaks yes no 0.09s
✅ REPOSITORY git_diff yes no 0.02s
✅ REPOSITORY grype yes no 15.26s
✅ REPOSITORY kics yes no 34.7s
✅ REPOSITORY secretlint yes no 0.99s
✅ REPOSITORY syft yes no 0.66s
❌ REPOSITORY trivy yes 1 13.52s
✅ REPOSITORY trivy-sbom yes no 7.77s
✅ REPOSITORY trufflehog yes no 5.21s
✅ YAML prettier 15 0 1.0s
✅ YAML yamllint 15 0 0.57s

See detailed report in MegaLinter reports

You could have same capabilities but better runtime performances if you request a new MegaLinter flavor.

_MegaLinter is graciously provided by OX Security_

miracum-bot commented 5 months ago

:tada: This issue has been resolved in version 3.1.8 :tada:

The release is available on GitHub release

Your semantic-release bot :package::rocket: