[rhoai-2.25] fix(cve): bump pyasn1 to >=0.6.4 for CVE-2026-59885 by BabbarPB08 · Pull Request #2625 · red-hat-data-services/notebooks

BabbarPB08 · 2026-07-27T22:23:20Z

Summary

Bumps pyasn1 from 0.6.3 to >=0.6.4 to fix CVE-2026-59885 (DoS via crafted ASN.1 OBJECT IDENTIFIER / RELATIVE-OID)
Updates dependencies/cve-constraints.txt and regenerates affected pylock.toml files
Tracker: RHAIENG-6370 (covers linked image CVEs RHOAIENG-78412 … RHOAIENG-78457)

Prefer same-repo PR for merge / full CI: #2633
Build Notebooks (push): https://github.com/red-hat-data-services/notebooks/actions/runs/30370187977

Fork PR CI cannot use SUBSCRIPTION_* / AIPCC_QUAY_BOT_* / GIT_CRYPT_KEY secrets — use #2633 for validation.

Test plan

Confirm all regenerated pylock.toml files pin pyasn1 to 0.6.4
Build Notebooks (push) on same-repo branch
Konflux builds pass for notebook images on rhoai-2.25

github-actions · 2026-07-27T22:23:27Z

@BabbarPB08 — This PR is from a fork.
The build-rhoai CI job was skipped because subscription
builds (RHEL, AIPCC) need secrets unavailable to forks.
ODH builds and code quality checks still ran.

Recommended: Push your branch to the main repo for full CI:

git remote add upstream https://github.com/red-hat-data-services/notebooks.git
git push upstream HEAD:BabbarPB08/your-branch-name

Then open a new PR from that branch.

No push access? A maintainer will cherry-pick and test your changes.

See CONTRIBUTING.md for details.

coderabbitai · 2026-07-27T22:23:48Z

📝 Walkthrough

Walkthrough

Changes

pyasn1 dependency update

Layer / File(s)	Summary
Security constraint `dependencies/cve-constraints.txt`	Replaces the pyasn1 CVE reference and raises the minimum version from `0.6.3` to `0.6.4`.
Python 3.12 lockfile pins `jupyter//ubi9-python-3.12/pylock.toml`, `runtimes//ubi9-python-3.12/pylock.toml`	Updates pyasn1 from `0.6.3` to `0.6.4` and refreshes distribution URLs, metadata, and SHA256 hashes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

red-hat-data-services/notebooks#2192: Updates pyasn1 constraints and lockfile versions.
red-hat-data-services/notebooks#2433: Updates pyasn1 constraints and regenerated lockfile entries.

Suggested reviewers: daniellutz, jiridanek, dibryant

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly names the pyasn1 CVE fix and version bump, matching the main change in the PR.
Description check	✅ Passed	The body includes the required summary and test plan, with only the template’s exact headings and checklist boxes omitted.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov-commenter · 2026-07-27T22:24:42Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (rhoai-2.25@8500837). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@             Coverage Diff              @@
##             rhoai-2.25   #2625   +/-   ##
============================================
  Coverage              ?       0           
============================================
  Files                 ?       0           
  Lines                 ?       0           
  Branches              ?       0           
============================================
  Hits                  ?       0           
  Misses                ?       0           
  Partials              ?       0

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

jupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml (1)
1-1: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Upgrade or regenerate the flagged click lock entry.

jupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml still pins click==8.1.8, which is below the fixed version for PYSEC-2026-2132. Regenerate/lock this file to a fixed click version so the OSV scanner finding is resolved alongside the CVE PR.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jupyter/pytorch`+llmcompressor/ubi9-python-3.12/pylock.toml at line 1,
Regenerate the autogenerated pylock.toml using uv so its click lock entry is
upgraded from 8.1.8 to a version fixed for PYSEC-2026-2132, while preserving the
rest of the dependency lockfile.
Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@jupyter/pytorch`+llmcompressor/ubi9-python-3.12/pylock.toml:
- Line 1: Regenerate the autogenerated pylock.toml using uv so its click lock
entry is upgraded from 8.1.8 to a version fixed for PYSEC-2026-2132, while
preserving the rest of the dependency lockfile.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c0ffe36-7987-45a3-8b4c-6b17a2c53d15

📥 Commits

Reviewing files that changed from the base of the PR and between 8711362 and d7fe079.

📒 Files selected for processing (17)

codeserver/ubi9-python-3.12/pylock.toml
dependencies/cve-constraints.txt
jupyter/datascience/ubi9-python-3.12/pylock.toml
jupyter/minimal/ubi9-python-3.12/pylock.toml
jupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml
jupyter/pytorch/ubi9-python-3.12/pylock.toml
jupyter/rocm/pytorch/ubi9-python-3.12/pylock.toml
jupyter/rocm/tensorflow/ubi9-python-3.12/pylock.toml
jupyter/tensorflow/ubi9-python-3.12/pylock.toml
jupyter/trustyai/ubi9-python-3.12/pylock.toml
runtimes/datascience/ubi9-python-3.12/pylock.toml
runtimes/minimal/ubi9-python-3.12/pylock.toml
runtimes/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml
runtimes/pytorch/ubi9-python-3.12/pylock.toml
runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml
runtimes/rocm-tensorflow/ubi9-python-3.12/pylock.toml
runtimes/tensorflow/ubi9-python-3.12/pylock.toml

jiridanek · 2026-07-28T14:28:11Z

CI analysis @ `d7fe079`

Mergeable: dirty (conflicts with tip) — rebase onto current rhoai-2.25 needed before merge.
Fork PR (no Konflux). Merge gates (code-quality / CodeQL / Semgrep / etc.) mostly green.

pyasn1 bump looks fine — AIPCC amd64 jupyter-datascience, runtime-datascience, CUDA, trustyai, etc. succeeded with pyasn1==0.6.4. Failures below are tip flakes / fork-lane noise, not CVE-constraint fallout.

Useful signal — AIPCC run 30310539849: 21✓ / 8✗

Job	Root cause
rocm-jupyter-pytorch / rocm-runtime-pytorch	ENOSPC writing `/var/tmp/container_images_storage*` (known #2554)
jupyter-minimal ppc64le / s390x	qemu OpenShift wait / CrashLoop (known tip flake)
runtime-datascience s390x	pyzmq compile under qemu (known tip flake)
jupyter-datascience ppc64le	numpy sdist No BLAS — tip now has #2534 `openblas-devel`; rebase should clear this
codeserver amd64 / arm64	image built OK; post-step missing `scripts/get_playwright_version.py` (tip/workflow mismatch — rebase should pick up tip script)

Ignore — PR-event run 30310541194: ~25✗ early

Fork without repo secrets (SUBSCRIPTION_*, AIPCC_QUAY_BOT_*, GIT_CRYPT_KEY). Codeserver×2 succeeded (no subscription). Expected for fork PRs — use AIPCC pull_request_target lane / same-repo branch for real build signal.

Recommended next

Rebase onto tip rhoai-2.25 (clears dirty + picks up [rhoai-2.25] fix(ppc64le): openblas-devel for ONNX numpy builds #2534 / [rhoai-2.25] RHAIENG-6036: fix trustyai k8s papermill probe timing #2487 / PDF+check-payload fixes).
Re-check AIPCC matrix; treat remaining pyzmq / ENOSPC / qemu as tip flakes unless new.

jiridanek · 2026-07-28T14:44:11Z

Rebased onto current rhoai-2.25 (8500837f) and force-pushed to the fork head (maintainerCanModify).

New HEAD: 185270cc

Conflict resolution:

cve-constraints.txt: kept tip pillow>=12.2.0; set pyasn1>=0.6.4 (CVE-2026-59885 / RHAIENG-6370)
pylocks: regenerated with gmake refresh-pipfilelock-files — only pyasn1 0.6.3 → 0.6.4 (+ hashes) in 12 locks (codeserver already on 0.6.4)

PR is MERGEABLE again (was CONFLICTING). CI should re-run on the new SHA.

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

jupyter/trustyai/ubi9-python-3.12/pylock.toml (1)
1707-1744: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

Remove the unrelated Pillow lockfile update.

This PR targets pyasn1 CVE-2026-59885, but this stanza also changes Pillow to 12.3.0 and refreshes its wheel set. Revert these Pillow changes or split them into a separately reviewed update so this image does not receive an unreviewed runtime dependency change.

Based on learnings, non-ROCm per-image lockfiles should not be regenerated in this CVE-fix flow; ROCm TensorFlow images are the documented exception.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@jupyter/trustyai/ubi9-python-3.12/pylock.toml` around lines 1707 - 1744,
Remove the unrelated Pillow 12.3.0 lockfile stanza and restore the prior Pillow
dependency entries, leaving only the pyasn1 CVE update in this change. Do not
regenerate non-ROCm per-image lockfiles for this CVE-fix flow; preserve lockfile
changes only where required for the documented ROCm TensorFlow exception.
Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@jupyter/trustyai/ubi9-python-3.12/pylock.toml`:
- Around line 1707-1744: Remove the unrelated Pillow 12.3.0 lockfile stanza and
restore the prior Pillow dependency entries, leaving only the pyasn1 CVE update
in this change. Do not regenerate non-ROCm per-image lockfiles for this CVE-fix
flow; preserve lockfile changes only where required for the documented ROCm
TensorFlow exception.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fc5a5c84-c391-45f6-aeb9-4eab18535e3e

📥 Commits

Reviewing files that changed from the base of the PR and between d7fe079 and 185270c.

📒 Files selected for processing (13)

dependencies/cve-constraints.txt
jupyter/datascience/ubi9-python-3.12/pylock.toml
jupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml
jupyter/pytorch/ubi9-python-3.12/pylock.toml
jupyter/rocm/pytorch/ubi9-python-3.12/pylock.toml
jupyter/rocm/tensorflow/ubi9-python-3.12/pylock.toml
jupyter/tensorflow/ubi9-python-3.12/pylock.toml
jupyter/trustyai/ubi9-python-3.12/pylock.toml
runtimes/datascience/ubi9-python-3.12/pylock.toml
runtimes/pytorch/ubi9-python-3.12/pylock.toml
runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml
runtimes/rocm-tensorflow/ubi9-python-3.12/pylock.toml
runtimes/tensorflow/ubi9-python-3.12/pylock.toml

🚧 Files skipped from review as they are similar to previous changes (1)

dependencies/cve-constraints.txt

jiridanek · 2026-07-28T14:48:55Z

Same-repo branch for full CI

Fork PR CI is expected to fail on RHEL/AIPCC (and similar) jobs: workflows from forks cannot access the required repo secrets. See CONTRIBUTING — Contributing from branches vs forks.

For RHDS, the recommended path is a PR from a branch pushed to red-hat-data-services/notebooks.

Same-repo branch: fix/rhoai-2.25-cve-2026-59885-pyasn1 @ 185270ccfad7e4bde078c00e7a9bca5eb63d8afa
Same-repo PR (please prefer this for merge): [rhoai-2.25] fix(cve): bump pyasn1 to >=0.6.4 for CVE-2026-59885 #2633
Build Notebooks (push) workflow_dispatch on that branch: https://github.com/red-hat-data-services/notebooks/actions/runs/30370187977

Leaving this fork PR open for reference; no need to close it unless you want to. Tracker: RHAIENG-6370.

jiridanek · 2026-07-28T16:34:24Z

/build-konflux

openshift-ci · 2026-07-29T08:16:30Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jiridanek

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jiridanek · 2026-07-29T08:17:01Z

Thanks @BabbarPB08 — rebased this branch onto current rhoai-2.25 and updated both remotes:

red-hat-data-services/notebooks → fix/rhoai-2.25-cve-2026-59885-pyasn1
BabbarPB08/notebooks → fork/cve-2026-59885-pyasn1-rhoai-2.25

After rebase, the pyasn1 commit is fully superseded by the merged CVE batch in #2634 (pyasn1>=0.6.4 is already on rhoai-2.25). The branch tip is now 6ae9aaa with no remaining diff vs base.

Closing as superseded by #2634 — your original change is landed; no further action needed on this PR.

openshift-ci Bot requested review from daniellutz and jiridanek July 27, 2026 22:23

github-actions Bot added the review-requested label Jul 27, 2026

coderabbitai Bot reviewed Jul 27, 2026

View reviewed changes

openshift-ci Bot added the needs-rebase label Jul 28, 2026

jiridanek force-pushed the fork/cve-2026-59885-pyasn1-rhoai-2.25 branch from d7fe079 to 185270c Compare July 28, 2026 14:43

openshift-ci Bot removed the needs-rebase label Jul 28, 2026

jiridanek approved these changes Jul 28, 2026

View reviewed changes

openshift-ci Bot assigned jiridanek Jul 28, 2026

openshift-ci Bot added the lgtm label Jul 28, 2026

jiridanek added tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. and removed lgtm labels Jul 28, 2026

openshift-ci Bot added the approved label Jul 28, 2026

jiridanek changed the title ~~fix(cve): bump pyasn1 to >=0.6.4 for CVE-2026-59885~~ [rhoai-2.25] fix(cve): bump pyasn1 to >=0.6.4 for CVE-2026-59885 Jul 28, 2026

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

jiridanek mentioned this pull request Jul 28, 2026

[rhoai-2.25] fix(cve): bump pyasn1 to >=0.6.4 for CVE-2026-59885 #2633

Closed

3 tasks

jiridanek mentioned this pull request Jul 28, 2026

chore(deps): fix open rhoai-2.25 pypi CVE batch via cve-constraints #2634

Merged

3 tasks

jiridanek closed this Jul 29, 2026

jiridanek force-pushed the fork/cve-2026-59885-pyasn1-rhoai-2.25 branch from 185270c to 6ae9aaa Compare July 29, 2026 08:16

openshift-ci Bot removed the approved label Jul 29, 2026

coderabbitai Bot mentioned this pull request Aug 4, 2026

[rhoai-3.4] Fix 15 CVEs: pillow, soupsieve, pyasn1, starlette + llmcompressor unblock #2699

Merged

4 tasks

Navigation Menu

Uh oh!

[rhoai-2.25] fix(cve): bump pyasn1 to >=0.6.4 for CVE-2026-59885 - #2625

[rhoai-2.25] fix(cve): bump pyasn1 to >=0.6.4 for CVE-2026-59885#2625
BabbarPB08 wants to merge 0 commit into
red-hat-data-services:rhoai-2.25from
BabbarPB08:fork/cve-2026-59885-pyasn1-rhoai-2.25

BabbarPB08 commented Jul 27, 2026 •

edited by atlassian Bot

Loading

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

codecov-commenter commented Jul 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

jiridanek commented Jul 28, 2026

Uh oh!

jiridanek commented Jul 28, 2026 •

edited by atlassian Bot

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

jiridanek commented Jul 28, 2026

Uh oh!

jiridanek commented Jul 28, 2026

Uh oh!

openshift-ci Bot commented Jul 29, 2026

Uh oh!

jiridanek commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

BabbarPB08 commented Jul 27, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

codecov-commenter commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

jiridanek commented Jul 28, 2026

CI analysis @ d7fe079

Useful signal — AIPCC run 30310539849: 21✓ / 8✗

Ignore — PR-event run 30310541194: ~25✗ early

Recommended next

Uh oh!

jiridanek commented Jul 28, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

jiridanek commented Jul 28, 2026

Same-repo branch for full CI

Uh oh!

jiridanek commented Jul 28, 2026

Uh oh!

openshift-ci Bot commented Jul 29, 2026

Uh oh!

jiridanek commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

BabbarPB08 commented Jul 27, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

codecov-commenter commented Jul 27, 2026 •

edited

Loading

CI analysis @ `d7fe079`

jiridanek commented Jul 28, 2026 •

edited by atlassian Bot

Loading