Skip to content

[rhoai-3.4] Fix 15 CVEs: pillow, soupsieve, pyasn1, starlette + llmcompressor unblock #2699

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mtchoum1 merged 5 commits into from
Aug 11, 2026
Merged

[rhoai-3.4] Fix 15 CVEs: pillow, soupsieve, pyasn1, starlette + llmcompressor unblock #2699

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1798293
Fix 10 Pillow CVEs: bump pillow>=12.3.0
crackcodecamp Aug 4, 2026
0f45564
Fix CVE-2026-49476,CVE-2026-49477: bump soupsieve>=2.8.4
crackcodecamp Aug 4, 2026
aa78df8
Fix CVE-2026-59886,CVE-2026-59884: bump pyasn1>=0.6.4
crackcodecamp Aug 4, 2026
a363398
Fix CVE-2026-54283: bump starlette>=1.3.1
crackcodecamp Aug 4, 2026
a67b464
Fix Pillow CVEs for llmcompressor images: bump llmcompressor 0.10.0.3
crackcodecamp Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 16 additions & 11 deletions codeserver/ubi9-python-3.12/requirements.cpu.txt
View file
Open in desktop
Comment thread
mtchoum1 marked this conversation as resolved.
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,8 @@ onnx==1.20.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:a9732f815fda1639da7da2e944dbaca68c75a931c513db554b6ce2f175b2ead9 \
--hash=sha256:e3c55648d21692275147c704b358c8e575a61ccccb700bccea2d3064ab2ed316
onnxconverter-common==1.16.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:23dc1d4b118e5cb5ea245603afc9f17b67c855b5cb93fa2dc510154cb18f795c
--hash=sha256:23dc1d4b118e5cb5ea245603afc9f17b67c855b5cb93fa2dc510154cb18f795c \
--hash=sha256:a1984033698675d036c6656a5cbdccb61fcf73ba0800079557b25c5833909543
opencensus==0.11.4 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:d22373d6a6c2e976b7d554e47bda1839f3651e0d665338fd5174c93c4070b765
opencensus-context==0.1.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
Expand All @@ -259,7 +260,11 @@ pandas==2.3.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:fe0a87d52babe4a95c84948e303a56edef5e6d6aa84bfd269e3a45674f8bdd53 \
--hash=sha256:42a2816775db605c26c228748c13c7df65323f49570a9d5b90a7f7dadec5d2e5 \
--hash=sha256:e4214e846115332db48099a32ec1f35cf25282a875b66fa358596cbf6b93e6f6 \
--hash=sha256:c21a8ade5db3865bfa78e734c41a949e43a817dc44bf94865559b25d3b4e7c3f
--hash=sha256:c21a8ade5db3865bfa78e734c41a949e43a817dc44bf94865559b25d3b4e7c3f \
--hash=sha256:874bf118802e3b353fc2ccdbeb50d88dabec955a6e5f40695b1e93f5e6d1459b \
--hash=sha256:3300130acdb89b4c1e5fc651c3db8c84828cf49a26c7ef5fc6357203dbec32b2 \
--hash=sha256:cdf1fd2e171f4eaa830c7ddc61b80d67db27e716c1806e86b6d19028f68f2c57 \
--hash=sha256:11a75fdb52eb65fe2d5bba26cbefd480406a4f3c43b4112212659ded2a858f18
parso==0.8.6 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:a45ac53bde97ca8c76f9cc9fb0c77a5bccadc5b6bf384c2cbd3b148f0f791512
partd==1.4.2 ; implementation_name == 'cpython' and sys_platform == 'linux' \
Expand All @@ -268,11 +273,11 @@ pathspec==1.0.4 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:01f65a227426547091048a89cbe280a92c26536850bd26c70b94e715ac28dc8f
pexpect==4.9.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:de875f7edd25fce79d755f04ed8ddd29e97ebeda66cc05c516ba760748e0090f
pillow==12.2.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:394981fc7445b3721bc5dd88b5859050eedfa51e307a986fdf832d2145555f59 \
--hash=sha256:7c86fb5c7df6c07cafe6f55dadfeb8e8cefb04e32a402b9d7ff05d1cb9823f97 \
--hash=sha256:321c3191fb27a8002ce6937076a2b9f9dba568a8f0d9b8febe843753b3166692 \
--hash=sha256:1d14bc0f26c4f17eae2bddfe2700bcc922c5e19bebad32145a52445ad0b2909d
pillow==12.3.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:a0ae23976c3a950d107fe1412f595be73c5d2de8071d26298a1f623bae5a58a1 \
--hash=sha256:02487f9b1900a101a6c2d743172bb916baa4c2b574a676f09751423d55d47496 \
--hash=sha256:c59cfb8d5dfeb4409f42c9a90b25c8f4b213434756c4f64c377fe51a34e53245 \
--hash=sha256:8dc435092a6842d8483be410e080e5c1eccd7aa991f30787cd9601eedcccf260
pip==26.1.2 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:25601b2e4c9967e70cfd53b362b909cc01facb76389cdc96d98b7153972c12c1
platformdirs==4.9.6 ; implementation_name == 'cpython' and sys_platform == 'linux' \
Expand Down Expand Up @@ -319,8 +324,8 @@ pyarrow==23.0.1 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:7f9b4ad7ec323af217e1fe8f02e0880f8857cad83bce34a3121fa6feb8755209 \
--hash=sha256:41de5e11db69bb9c4af31976c6743d7e43beb7c7620ec7b81d133caf6ba67276 \
--hash=sha256:21855f7fa76d32250847d3f73aefbc6993e6e92b7c48a2651aeedbdc1a25e37a
pyasn1==0.6.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:51194c7b4281edb039247c23e11f5280b4c9713ec246fda1fa9b5d960b860e51
pyasn1==0.6.4 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:a25a6225c5324044f92c9a04b8381580245aa54498a4d05e9600ada4f2308c26
pyasn1-modules==0.4.2 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:789033a94c5074562252314a4362858e2c173b04c7ae8dc1173ac69ce1f5cd7e
pycparser==3.0 ; python_full_version >= '3.9' and implementation_name == 'cpython' and platform_python_implementation != 'PyPy' and sys_platform == 'linux' \
Expand Down Expand Up @@ -409,8 +414,8 @@ sqlparse==0.5.5 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:e14e47d6edcac7eaf3e6a1cf85c236e9c71f06e269b16928da76ad47683d4a8f
stack-data==0.6.3 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:074f4a60339970ce76773f3eb9eb2c88591f83d335f5764551610cb07597a3c9
starlette==1.2.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:f883e3b1dad66859b3cd5cc398fd234ff14286a0bd98ac6fdaf696f4fe449b7b
starlette==1.3.1 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:1076ce1d57b000b509f126da9bb439b4af3ebd798fe4fa998a02640d4d3fe92f
tabulate==0.10.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
--hash=sha256:fc9b49298a10c6cca931828963e093e59a17b96e53099ac930a2bcc5aa832273
tenacity==8.5.0 ; implementation_name == 'cpython' and sys_platform == 'linux' \
Expand Down
29 changes: 18 additions & 11 deletions codeserver/ubi9-python-3.12/uv.lock.d/pylock.cpu.toml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

13 changes: 10 additions & 3 deletions dependencies/cve-constraints.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,12 @@ urllib3>=2.6.0
# RHAIENG-2893: CVE-2026-0897 Keras: Denial of Service via crafted HDF5 weight loading file
keras>=3.13.1
# RHAIENG-3210: CVE-2026-25990 Pillow: Out-of-bounds Write via Specially Crafted PSD Image
pillow>=12.1.1
# + CVE-2026-59200, CVE-2026-54058, CVE-2026-59199, CVE-2026-59197, CVE-2026-59205
# + CVE-2026-59204, CVE-2026-54060, CVE-2026-55380, CVE-2026-55379, CVE-2026-42311
pillow>=12.3.0
Comment thread
coderabbitai[bot] marked this conversation as resolved.
# RHAIENG-5357: CVE-2026-48710 Starlette: Security restriction bypass via malformed HTTP Host header
starlette>=1.0.1
# + CVE-2026-54283: Starlette request.form() limits silently ignored
starlette>=1.3.1
# RHAIENG-5490: CVE-2026-34993 AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
aiohttp>=3.14.0
# RHAIENG-6095: CVE-2026-42215 GitPython: Arbitrary command execution via dangerous Git option bypass
Expand All @@ -42,4 +45,8 @@ ujson>=5.12.1
# RHAIENG-5875: CVE-2026-56121 Feast: RCE via Unsafe Deserialization in gRPC Registry Server
feast>=0.63.0
# RHOAIENG-64079: CVE-2026-8643 pip: Path traversal via malicious entry point name in wheel install
pip>=26.1.2
pip>=26.1.2
# CVE-2026-49476, CVE-2026-49477: Soupsieve DoS via crafted CSS selector strings
soupsieve>=2.8.4
# CVE-2026-59886, CVE-2026-59884: pyasn1 DoS via crafted ASN.1/BER input
pyasn1>=0.6.4
Loading
Loading