GitHub user bhargavmehta01 added a comment to the discussion: Superset 6.1: is flask-caching still structurally required when runtime uses NullCache and SupersetMetastoreCache?
@bsethi24 Good news on the CVE: CVE-2021-33026 doesn't cover the Flask-Caching 2.x line, so it shouldn't be what's blocking your 6.1.0 build. - **Affected range.** The GitHub advisory [GHSA-656c-6cxf-hvcv](https://github.com/advisories/GHSA-656c-6cxf-hvcv) lists the affected versions as `<= 1.10.1`. NVD's CPE configuration also ends at `versionEndIncluding: 1.10.1`. Superset 6.1.0 requires `flask-caching>=2.1.0, <3` and pins `2.3.1`, so none of the versions blocked in your mirror (2.0.2 to 2.5.1) is in either record's range. A scanner that flags them is matching on the package name, not the version. That's a false positive you can take back to your security team or mirror vendor with those two links. - **Severity.** The 9.8 is NVD's score. GitHub rates the advisory *Moderate*, and the CVE is tagged **disputed**. The maintainers' position is that an attack needs write access to the cache storage plus a colliding cache key. Anyone with that access already controls what the app serves. - **Your config.** `NullCache` stores nothing, so there's nothing to deserialize. For the two `SupersetMetastoreCache` configs, keep `"CODEC": JsonKeyValueCodec()` in your overrides. That's the 6.1.0 default in `config.py`, but `SupersetMetastoreCache.factory` falls back to `PickleKeyValueCodec` when `CODEC` is missing, and logs "Using PickleKeyValueCodec with SupersetMetastoreCache may be unsafe". With JSON there's no pickle anywhere in the runtime you described. ```python from superset.key_value.types import JsonKeyValueCodec FILTER_STATE_CACHE_CONFIG = { "CACHE_TYPE": "SupersetMetastoreCache", "CACHE_DEFAULT_TIMEOUT": 7776000, "REFRESH_TIMEOUT_ON_RETRIEVAL": True, "CODEC": JsonKeyValueCodec(), } EXPLORE_FORM_DATA_CACHE_CONFIG = { "CACHE_TYPE": "SupersetMetastoreCache", "CACHE_DEFAULT_TIMEOUT": 7776000, "REFRESH_TIMEOUT_ON_RETRIEVAL": True, "CODEC": JsonKeyValueCodec(), } ``` - **Remediation path.** Allowlist `flask-caching==2.3.1`, the version 6.1.0 pins and tests against. Record the exception against the advisory's `<= 1.10.1` range. Neither record lists a 2.x release as affected, so there's no "fixed" release to wait for. Removing the package isn't an option, as @dfbustosus explained above. - **If you add Redis later,** the CVE's precondition is write access to the cache store, so lock that down: a private network endpoint, `requirepass` or ACLs with the secret pulled from your secret manager, and TLS (`rediss://`). How I checked: the OSV/GitHub advisory record and the NVD API record for CVE-2021-33026, plus `pyproject.toml`, `requirements/base.txt`, `superset/config.py` and `superset/extensions/metastore_cache.py` at the `6.1.0` tag. GitHub link: https://github.com/apache/superset/discussions/44823#discussioncomment-18873416 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
