Update pyasn1 to newer version#717
Conversation
|
This may not work outside of upstream builds or in places where building from source is a requirement. Also, would it make sense to nuke the old one too? Something like: |
The pyasn1 which is installed in base container image has installed vulnerable version of pyasn1 library. Update the library to latest version [1] [1] https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
|
Build failed (check pipeline). Post ✔️ stf-crc-ocp_418-local_build SUCCESS in 50m 52s |
|
recheck |
|
@lhh is it fine ? |
The pyasn1 which is installed in base container image has installed vulnerable version of pyasn1 library. Update the library to latest version [1] Related-To: OSPRH-32894 Similar approach was done in service-telemetry-operator [2] [1] https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 [2] infrawatch/service-telemetry-operator#717 Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
The pyasn1 which is installed in base container image has installed vulnerable version of pyasn1 library. Update the library to latest version [1] Related-To: OSPRH-32894 Similar approach was done in service-telemetry-operator [2] [1] https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 [2] infrawatch/service-telemetry-operator#717 Signed-off-by: Daniel Pawlik <dpawlik@redhat.com>
|
It's fine; turns out the source image didn't have it, but this keeps the BOM clear if it ever did have it: Same caveats we discussed apply (fine for these upstream builds, not fine in any place things need to be built from source). I'd rather it wasn't needed; hopefully the image you are sourcing here publishes a proper update. |
3 participants
The pyasn1 which is installed in base container image has installed vulnerable version of pyasn1 library.
Update the library to latest version [1]
Related-To: OSPRH-32895
[1] https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4