Remove CVE-2026-15308#299
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
TamarW0
changed the title
zvigrinberg
left a comment
zvigrinberg
left a comment
There was a problem hiding this comment.
@TamarW0 The fix is good but not complete, Anyway, it's always better to search for the root cause and eliminate it without logic changes.
Third party libs that uses that internally are exposed ( if will be triggered by the application).
Why not just upgrading the python version ( dockerfile' base image ) to a fixed version in python 3.12.x versions ranges?
This is the fix in python runtime - cpython ( python/cpython@7933f4b), it's already patched in the recent image digests of python ubi9-3.12.
Much more easier, less impact, no logic changes.
Another issue, please change the title of the PR to mitigate CVE-2026-15308, and also link the jira ticket being fixed.
Thanks.
| }, | ||
| max_retries=self._retry_count, | ||
| retry_on_client_errors=self._retry_on_client_errors) as response: | ||
| return BeautifulSoup(await response.text(), 'html.parser') |
There was a problem hiding this comment.
@TamarW0 Your comment make sense, thus it's less likely, but compromised cwe.mitre.org source can cause DOS.
There was a problem hiding this comment.
@TamarW0
Based on our conversation with @zvigrinberg we believe we have a better way to mitigate this issue.
The latest ubi9/python-312 container image already contains the necessary fix.
You can validate it with
podman run --rm registry.redhat.io/ubi9/python-312:9.8-1784177776 python -c "from html.parser import HTMLParser; p=HTMLParser(); print('patched' if hasattr(p,'_pending') else 'VULNERABLE')"The second thing is uv, which manages the Python env separately and downloads uv-based images.
It can be fixed with UV_PYTHON_DOWNLOADS=never uv venv --python /usr/bin/python3.12 .venv instead of uv venv --python ${PYTHON_VERSION} /workspace/.venv in Dockerfile.
@zvigrinberg FYI
| "faiss-cpu==1.9.0", | ||
| "gitpython~=3.1.49", # CVE-2026-42284, CVE-2026-42215, CVE-2026-44244 | ||
| "google-search-results==2.4", | ||
| "lxml>=5.0.0", |
There was a problem hiding this comment.
@TamarW0 bound or pin the version interval to something like lxml>=5.0.0,<7, to avoid future side effects.
| ENV PYTHONDONTWRITEBYTECODE=1 \ | ||
| AGENT_GIT_COMMIT=${AGENT_GIT_COMMIT} \ | ||
| AGENT_GIT_TAG=${AGENT_GIT_TAG} | ||
|
|
There was a problem hiding this comment.
@TamarW0 Missing switching to root user here in order to perform installations that requires root permissions
USER 0Then it's anyway switch to user id 1001 at the end https://github.com/RHEcosystemAppEng/exploit-iq-agent/pull/299/changes#diff-dd2c0eb6ea5cfc6c4bd4eac30934e2d5746747af48fef6da689e85b752f39557R136
3 participants
No description provided.