codeant-ai-for-open-source[bot] commented on code in PR #45186: URL: https://github.com/apache/superset/pull/45186#discussion_r4241221326
########## docs/admin_docs/security/dependency-vulnerability-remediation.mdx: ########## @@ -0,0 +1,77 @@ +--- +title: Dependency Vulnerability Remediation & Scanner Guidance +sidebar_position: 3 +--- + +# Dependency Vulnerability Remediation & Container Scanner Guidance + +This guide addresses third-party dependency vulnerabilities reported by container security scanners (such as Trivy, Grype, and Snyk) in Apache Superset environments, specifically regarding dependency constraint handling for cryptography, msgpack, and pyarrow (referencing issue #45087). + +## 1. Vulnerability Applicability & Risk Assessment + +When security scanners evaluate Apache Superset container images, findings frequently arise in transitive or pinned direct dependencies. The table below details the applicability and actual exploitability surface of recently reported findings: + +| Package | Finding ID | Severity | Remediation Floor | Superset Code Path & Exploitability Analysis | +| :--- | :--- | :--- | :--- | :--- | +| **cryptography** | CVE-2026-69247, CVE-2026-69249, GHSA-537c-gmf6-5ccf, CVE-2026-69248 | HIGH / MEDIUM | `>=48.0.1` (resolved in `50.0.2`) | Used primarily for encrypting database connection passwords at rest and parsing operator-supplied SSL certificates. Unauthenticated external input does not traverse PKCS12 parsing routines. Exploitability in standard deployments is considered low. | +| **msgpack** | GHSA-6v7p-g79w-8964 | HIGH | `>=1.2.1` (resolved in `1.2.3`) | Utilized internally for SQL Lab asynchronous query result serialization (`RESULTS_BACKEND_USE_MSGPACK`). Raw msgpack byte streams are generated and consumed only within the trusted backend cache boundary. Exploitability requires full cache store compromise. | +| **pyarrow** | CVE-2026-25087 | HIGH | `>=23.0.1` (resolved in `25.0.1`) | Used for columnar tabular transformations and CSV/Parquet ingestion by authenticated users. Ingestion pathways are governed by role-based permissions and file size limits. Exploitability is bounded to authorized data uploads. | Review Comment: **Suggestion:** The guide calls 23.0.1 the remediation floor for CVE-2026-25087, while the requirements set 25.0.1; operators following the lower floor may install a release this PR does not treat as remediated. **Assessment:** ๐ `Major` ยท ๐ `Occurrence: Sometimes` ยท ๐ท๏ธ `Security` [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=cadd648753b64522b20624ebb8f4cb5f&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=cadd648753b64522b20624ebb8f4cb5f&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** docs/admin_docs/security/dependency-vulnerability-remediation.mdx **Line:** 18:18 **Comment:** *Security: The guide calls 23.0.1 the remediation floor for CVE-2026-25087, while the requirements set 25.0.1; operators following the lower floor may install a release this PR does not treat as remediated. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F45186&comment_hash=299ee905f29508971867369a5e319820318c837ec857991b98881e71feff807a&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F45186&comment_hash=299ee905f29508971867369a5e319820318c837ec857991b98881e71feff807a&reaction=dislike'>๐</a> ########## pyproject.toml: ########## @@ -50,7 +50,7 @@ dependencies = [ "flask-cors>=6.0.5, <7.0", "croniter>=6.2.4", "cron-descriptor", - "cryptography>=50.0.2, <51.0.0", + "cryptography>=48.0.1, <51.0.0", Review Comment: **Suggestion:** The base requirements set 50.0.2 as the floor for CVE-2026-34073, but this range permits 48.0.1 through 50.0.1, so fresh installs can retain affected releases. **Assessment:** ๐ `Major` ยท ๐ `Occurrence: Rarely` ยท ๐ท๏ธ `Security` [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=efe0ca8e530f47c4a12a14b69e75d854&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=efe0ca8e530f47c4a12a14b69e75d854&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** pyproject.toml **Line:** 53:53 **Comment:** *Security: The base requirements set 50.0.2 as the floor for CVE-2026-34073, but this range permits 48.0.1 through 50.0.1, so fresh installs can retain affected releases. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F45186&comment_hash=e8f09251f79026869bcd10e45c4b101b9e332295f04eb69e80a192af89d0a252&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F45186&comment_hash=e8f09251f79026869bcd10e45c4b101b9e332295f04eb69e80a192af89d0a252&reaction=dislike'>๐</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
