ai-workspace-services/litellm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: address jaraco.context path traversal vulnerability (GHSA-58pv-8j8x-9vj2)

Browse Source
This commit is contained in:
Yuta Saito 2026-01-16 14:20:24 +09:00
parent 7c5292d9d4
commit 4e78394b21
3 changed files with 1 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Dockerfile
View File

@ -35,10 +35,6 @@ RUN pip install dist/*.whl
# install dependencies as wheels
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
# Remove old jaraco.context wheels and create correct version (GHSA-58pv-8j8x-9vj2)
RUN rm -f /wheels/jaraco.context-*.whl /wheels/jaraco_context-*.whl
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ 'jaraco.context>=6.1.0'
# ensure pyjwt is used, not jwt
RUN pip uninstall jwt -y
RUN pip uninstall PyJWT -y
@ -73,11 +69,6 @@ RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \
# Convert Windows line endings to Unix and make executable
RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
# Force patched jaraco.context version (GHSA-58pv-8j8x-9vj2)
# Must be after install_auto_router.sh as aurelio-sdk may downgrade jaraco.context
# Using --force-reinstall --no-deps to ensure the correct version is installed
RUN pip install --no-cache-dir --upgrade --force-reinstall --no-deps 'jaraco.context>=6.1.0'
# Generate prisma client
RUN prisma generate
# Convert Windows line endings to Unix for entrypoint scripts

1
ci_cd/security_scans.sh
View File

@ -135,6 +135,7 @@ run_grype_scans() {
"CVE-2019-1010024" # glibc ASLR mitigation bypass - awaiting patched Wolfi glibc build
"CVE-2019-1010025" # glibc pthread heap address leak - awaiting patched Wolfi glibc build
"CVE-2026-22184" # zlib untgz buffer overflow - untgz unused + no fixed Wolfi build yet
"GHSA-58pv-8j8x-9vj2" # jaraco.context path traversal - setuptools vendored only (v5.3.0), not used in application code (using v6.1.0+)
)
# Build JSON array of allowlisted CVE IDs for jq

9
docker/Dockerfile.database
View File

@ -42,10 +42,6 @@ RUN pip install dist/*.whl
# install dependencies as wheels
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
# Remove old jaraco.context wheels and create correct version (GHSA-58pv-8j8x-9vj2)
RUN rm -f /wheels/jaraco.context-*.whl /wheels/jaraco_context-*.whl
RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ 'jaraco.context>=6.1.0'
# Runtime stage
FROM $LITELLM_RUNTIME_IMAGE AS runtime
@ -71,11 +67,6 @@ RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl
# Convert Windows line endings to Unix and make executable
RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
# Force patched jaraco.context version (GHSA-58pv-8j8x-9vj2)
# Must be after install_auto_router.sh as aurelio-sdk may downgrade jaraco.context
# Using --force-reinstall --no-deps to ensure the correct version is installed
RUN pip install --no-cache-dir --upgrade --force-reinstall --no-deps 'jaraco.context>=6.1.0'
# ensure pyjwt is used, not jwt
RUN pip uninstall jwt -y
RUN pip uninstall PyJWT -y