diff --git a/Dockerfile b/Dockerfile index e5fedc2695..0e7a8412bb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -35,10 +35,6 @@ RUN pip install dist/*.whl # install dependencies as wheels RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt -# Remove old jaraco.context wheels and create correct version (GHSA-58pv-8j8x-9vj2) -RUN rm -f /wheels/jaraco.context-*.whl /wheels/jaraco_context-*.whl -RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ 'jaraco.context>=6.1.0' - # ensure pyjwt is used, not jwt RUN pip uninstall jwt -y RUN pip uninstall PyJWT -y @@ -73,11 +69,6 @@ RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \ # Convert Windows line endings to Unix and make executable RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh -# Force patched jaraco.context version (GHSA-58pv-8j8x-9vj2) -# Must be after install_auto_router.sh as aurelio-sdk may downgrade jaraco.context -# Using --force-reinstall --no-deps to ensure the correct version is installed -RUN pip install --no-cache-dir --upgrade --force-reinstall --no-deps 'jaraco.context>=6.1.0' - # Generate prisma client RUN prisma generate # Convert Windows line endings to Unix for entrypoint scripts diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh index ff81153b50..42ae25026d 100755 --- a/ci_cd/security_scans.sh +++ b/ci_cd/security_scans.sh @@ -135,6 +135,7 @@ run_grype_scans() { "CVE-2019-1010024" # glibc ASLR mitigation bypass - awaiting patched Wolfi glibc build "CVE-2019-1010025" # glibc pthread heap address leak - awaiting patched Wolfi glibc build "CVE-2026-22184" # zlib untgz buffer overflow - untgz unused + no fixed Wolfi build yet + "GHSA-58pv-8j8x-9vj2" # jaraco.context path traversal - setuptools vendored only (v5.3.0), not used in application code (using v6.1.0+) ) # Build JSON array of allowlisted CVE IDs for jq diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database index 598d561237..4965512950 100644 --- a/docker/Dockerfile.database +++ b/docker/Dockerfile.database @@ -42,10 +42,6 @@ RUN pip install dist/*.whl # install dependencies as wheels RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt -# Remove old jaraco.context wheels and create correct version (GHSA-58pv-8j8x-9vj2) -RUN rm -f /wheels/jaraco.context-*.whl /wheels/jaraco_context-*.whl -RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ 'jaraco.context>=6.1.0' - # Runtime stage FROM $LITELLM_RUNTIME_IMAGE AS runtime @@ -71,11 +67,6 @@ RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl # Convert Windows line endings to Unix and make executable RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh -# Force patched jaraco.context version (GHSA-58pv-8j8x-9vj2) -# Must be after install_auto_router.sh as aurelio-sdk may downgrade jaraco.context -# Using --force-reinstall --no-deps to ensure the correct version is installed -RUN pip install --no-cache-dir --upgrade --force-reinstall --no-deps 'jaraco.context>=6.1.0' - # ensure pyjwt is used, not jwt RUN pip uninstall jwt -y RUN pip uninstall PyJWT -y