Skip to content
This repository was archived by the owner on Jun 2, 2025. It is now read-only.

Upgrade to Python3.6.13 #21

Merged
merged 1 commit into from
Feb 19, 2021
Merged

Upgrade to Python3.6.13 #21

merged 1 commit into from
Feb 19, 2021

Conversation

mahithsuresh
Copy link
Contributor

@mahithsuresh mahithsuresh commented Feb 19, 2021

openjdk:8 (the base image used by the spark container) has a dependency on python 2.7.16 which has a security vulnerability. Since openjdk:8 has not been updated and since python 2.7.16 has reached EOL, we are upgrading to python 3.6.13 which contains the fix for the vulnerability.

Upgraded to Python-3.6.13

Testing:

  1. Scanned in ECR and the vulnerability is gone.
  2. Exec’d into the container and the script worked as expected (no buffer overflows)
  3. Ran integration tests
  4. Ran manual tests that we used to deploy the last CM

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

…on 3.6.13

openjdk:8 (the base image used by the spark container) has a dependency on python 2.7.16 which has a security vulnerability. Since openjdk:8 has not been updated and since python 2.7.16 has reached EOL, we are upgrading to python 3.6.13 which contains the fix for the vulnerability.
Copy link

@kkoppolu1 kkoppolu1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is 2.7 impacted?
According to https://nvd.nist.gov/vuln/detail/CVE-2021-3177
only Python 3.x is impacted

@mahithsuresh
Copy link
Contributor Author

Is 2.7 impacted?
According to https://nvd.nist.gov/vuln/detail/CVE-2021-3177
only Python 3.x is impacted

Yeah - we use openjdk:8: https://snyk.io/test/docker/openjdk:8
it relies on 2.7 which has a the buffer overflow vulnerability according to this.
I also ran the python scripts that were using to determine whether there is impact and that confirmed it.

Copy link

@vdantu vdantu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes look good.

@mahithsuresh mahithsuresh merged commit 28017d2 into master Feb 19, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants