FrancescoCastaldi commented on code in PR #45186: URL: https://github.com/apache/superset/pull/45186#discussion_r4258936619
########## docs/admin_docs/security/dependency-vulnerability-remediation.mdx: ########## @@ -0,0 +1,89 @@ +--- +title: Dependency Vulnerability Remediation & Scanner Guidance +sidebar_position: 3 +--- + +# Dependency Vulnerability Remediation & Container Scanner Guidance + +This guide addresses third-party dependency vulnerabilities reported by container security scanners (such as Trivy, Grype, and Snyk) in Apache Superset environments, specifically regarding dependency constraint handling for cryptography, msgpack, and pyarrow (referencing issue #45087). + +## 1. Vulnerability Applicability & Risk Assessment + +When security scanners evaluate Apache Superset container images, findings frequently arise in transitive or pinned direct dependencies. The table below details the applicability and actual exploitability surface of recently reported findings: + +| Package | Finding ID | Severity | Remediation Floor | Superset Code Path & Exploitability Analysis | +| :--- | :--- | :--- | :--- | :--- | +| **cryptography** | CVE-2026-69247 | HIGH | `>=50.0.0` | PKCS#7 EnvelopedData decryption denial of service. Superset does not consume, parse, or decrypt PKCS#7 or S/MIME enveloped data. | Review Comment: Updated the vulnerability table in dependency-vulnerability-remediation.mdx (commit a3f73c0): - Added dedicated 'Upstream Fixed Version' column reflecting the first-fixed upstream releases (50.0.0 for CVE-2026-69247, 49.0.0 for CVE-2026-69249, 48.0.1 for GHSA-537c-gmf6-5ccf / CVE-2026-34180), while calling out Superset's chosen >=50.0.2 target floor separately under 'Superset Target Floor'. - Corrected the CVE-2026-69247 description to reflect the Bleichenbacher timing and error decryption oracle in PKCS#7 EnvelopedData. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
