Skip to content

[rhoai-3.4] Fix CVEs: aiohttp, gitpython, pyjwt #2521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jiridanek merged 10 commits into from
Jul 22, 2026
+779 −755
Merged

[rhoai-3.4] Fix CVEs: aiohttp, gitpython, pyjwt #2521

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c1f9723
Fix CVE-2026-34993: bump aiohttp>=3.14.0
crackcodecamp Jul 13, 2026
b9e0825
Fix CVE-2026-42215,CVE-2026-42284,CVE-2026-44244: bump gitpython>=3.1.50
crackcodecamp Jul 13, 2026
26ddc18
Fix CVE-2026-48526: bump pyjwt>=2.13.0
crackcodecamp Jul 13, 2026
480c744
Fix CVE-2026-33079,CVE-2026-49851: bump mistune>=3.3.0
crackcodecamp Jul 15, 2026
ac3592e
Fix CVE-2026-12243,CVE-2026-54293: bump nltk>=3.10.0
crackcodecamp Jul 15, 2026
4139972
Fix CVE-2026-35397,CVE-2026-44727,CVE-2026-5422: bump jupyter-server>…
crackcodecamp Jul 15, 2026
7d9c6c6
Fix CVE-2026-42266: bump jupyterlab>=4.5.7
crackcodecamp Jul 15, 2026
2e7ab02
Fix CVE-2026-44660: bump ujson>=5.12.1
crackcodecamp Jul 15, 2026
62afb41
Fix CVE-2026-56121: bump feast>=0.63.0
crackcodecamp Jul 15, 2026
6e7f3d9
Fix CVE-2026-8643: bump pip>=26.1.2
crackcodecamp Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions codeserver/ubi9-python-3.12/requirements.cpu.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,8 +78,8 @@ executing==2.2.1 ; implementation_name == 'cpython' and sys_platform == 'linux'
--hash=sha256:647b720dfae442bdc92e65b6e3eaa47f698b80539a0ff3b3766e8027cdae7994
fastapi==0.135.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:5404e349a8a9259bf976f0d8abd6453dba70f4d5f82bc7b733719ab7cf128a50
feast==0.62.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:83f7e588ad0e5c52de53fdacf7e6b29bc7895e3f03f135e1f6153363be0560fa
feast==0.63.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:04eecde7aa78eefc81ed4137b5886b61fbb2d33977564f2a1fd00412cd6575e8
filelock==3.25.2 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:ff122a5a2afb7ece0ba72e8f89dd24aba7da0d56683795babad4c5894b37493b
flask==3.1.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
Expand All @@ -92,8 +92,8 @@ fsspec==2026.3.0 ; implementation_name == 'cpython' and sys_platform == 'linux'
--hash=sha256:ec228d12e40742da7c869a80532b5619cd29b3e7219b8cec5d1afb78f8fc22be
gitdb==4.0.12 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:be784ee25c084b5e2d0fc901e07f0f2329b33e88ede8a865f0241c14dbfaa810
gitpython==3.1.46 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:40a88f5f702a85cbf76476b3638df5f6d32c13bab63b6d7fa59e5618865f1c75
gitpython==3.1.50 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:3b998a55c99ab6e105ddd9d2ce8db20597be3133d761a8d9287fc6f3e4b57530
google-api-core==2.30.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:e6c1fe933af45247a34d4be5de322b8b8003d2412cfaea62b5b98402bf3b1f87
google-auth==2.49.2 ; implementation_name == 'cpython' and sys_platform == 'linux' \
Expand Down Expand Up @@ -273,8 +273,8 @@ pillow==12.2.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:7c86fb5c7df6c07cafe6f55dadfeb8e8cefb04e32a402b9d7ff05d1cb9823f97 \
--hash=sha256:321c3191fb27a8002ce6937076a2b9f9dba568a8f0d9b8febe843753b3166692 \
--hash=sha256:1d14bc0f26c4f17eae2bddfe2700bcc922c5e19bebad32145a52445ad0b2909d
pip==26.0.1 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:7bc90fdf850eb57232f3c6ac2ce2d3bdc7d955cd58953f8cf1ec552424263167
pip==26.1.2 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:25601b2e4c9967e70cfd53b362b909cc01facb76389cdc96d98b7153972c12c1
platformdirs==4.9.6 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:52fd82200d1f288d04873722b914d30221ae588fcdfd96e563b931f828b9bcde
plotly==6.7.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
Expand Down Expand Up @@ -334,8 +334,8 @@ pydantic-core==2.41.5 ; implementation_name == 'cpython' and sys_platform == 'li
--hash=sha256:58224aa20706107ee7c03a10531224f0e5c6527f86f7ce6813d60c689bdb05f0
pygments==2.20.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:22eb8865e5accd0fc529e4fdc5cf74db3e6b2b6348b43a089950c8ce671dedb3
pyjwt==2.12.1 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:573e3a20893e430560b717bf5590889aed796c2693804e70ce5155995f3a12b3
pyjwt==2.13.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:43798d73ce4c0a7221087b220935ade361955eeada0b3b4f8622f9b53916ea1c
pyparsing==3.3.2 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:4fb4ea2103bc5ee9bc3949f973fde987a9d3a8d2d88865cee7293bdb00d00bf3
python-dateutil==2.9.0.post0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
Expand Down
18 changes: 9 additions & 9 deletions codeserver/ubi9-python-3.12/uv.lock.d/pylock.cpu.toml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

28 changes: 27 additions & 1 deletion dependencies/cve-constraints.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,30 @@ keras>=3.13.1
# RHAIENG-3210: CVE-2026-25990 Pillow: Out-of-bounds Write via Specially Crafted PSD Image
pillow>=12.1.1
# RHAIENG-5357: CVE-2026-48710 Starlette: Security restriction bypass via malformed HTTP Host header
starlette>=1.0.1
starlette>=1.0.1
# RHAIENG-5490: CVE-2026-34993 AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
aiohttp>=3.14.0
# RHAIENG-6095: CVE-2026-42215 GitPython: Arbitrary command execution via dangerous Git option bypass
# RHAIENG-6096: CVE-2026-42284 GitPython: Arbitrary code execution via improper clone option validation
# RHAIENG-6101: CVE-2026-44244 GitPython: Arbitrary code execution via injected newlines in Git config
gitpython>=3.1.50
# RHAIENG-5796: CVE-2026-48526 PyJWT: Authentication bypass due to forged JSON Web Tokens
pyjwt>=2.13.0
# RHAIENG-6084: CVE-2026-33079 Mistune: ReDoS via crafted Markdown input
# RHAIENG-5885: CVE-2026-49851 Mistune: DoS via crafted Markdown input
mistune>=3.3.0
# RHAIENG-5989: CVE-2026-12243 NLTK: Information disclosure via path traversal
# RHAIENG-5888: CVE-2026-54293 NLTK: Information Disclosure via Path Traversal in nltk.data.load()
nltk>=3.10.0
# RHAIENG-5833: CVE-2026-35397 Jupyter Server: Unauthorized File Access via Path Traversal
# RHAIENG-5852: CVE-2026-44727 Jupyter Server: RCE via stored XSS in nbconvert handlers
# RHAIENG-5802: CVE-2026-5422 jupyter-server: Sensitive data exposure via path traversal
jupyter-server>=2.20.0
# RHAIENG-5897: CVE-2026-42266 JupyterLab: Arbitrary code execution via extension allow-list bypass
jupyterlab>=4.5.7
# RHAIENG-5793: CVE-2026-44660 UltraJSON: Memory leak leading to Denial of Service
ujson>=5.12.1
# RHAIENG-5875: CVE-2026-56121 Feast: RCE via Unsafe Deserialization in gRPC Registry Server
feast>=0.63.0
# RHOAIENG-64079: CVE-2026-8643 pip: Path traversal via malicious entry point name in wheel install
pip>=26.1.2
Loading
Loading