FrancescoCastaldi commented on PR #45186:
URL: https://github.com/apache/superset/pull/45186#issuecomment-6180881414
### Review Resolution and Verification Update
All review feedback from @sadpandajoe and @hainenber has been addressed and
verified:
1. **UPDATING.md Clarification**:
Updated the upgrade note entry to accurately describe the concrete
changes: adding `msgpack>=1.2.3, <1.3` in `requirements/base.in`, bumping the
`pyarrow` constraint floor in `superset-core/pyproject.toml` to `>=25.0.1,
<26`, and documenting advisory-specific container remediation guidance in
`docs/admin_docs/security/dependency-vulnerability-remediation.mdx`. Removed
misleading references to relaxing constraints in `pyproject.toml`.
2. **Advisory-Specific Reachability Analysis in Remediation Guide**:
In `docs/admin_docs/security/dependency-vulnerability-remediation.mdx`,
replaced generalized PKCS12 rationale with advisory-specific reachability and
exploitability analysis for each CVE:
* `CVE-2026-69247`: PKCS#7 EnvelopedData decryption is not invoked by
Superset.
* `CVE-2026-69249`: X.509 path-building algorithm denial of service with
duplicate intermediates; Superset parses leaf database SSL certificates using
`load_pem_x509_certificate` and does not build untrusted certification paths
during request processing.
* `CVE-2026-69248`: PolicyBuilder wildcard-DNS verifier APIs are not
invoked by Superset.
* `GHSA-537c-gmf6-5ccf` (`CVE-2026-34180`): Bundled OpenSSL in wheels,
remediated in upstream wheels from 48.0.1 and pinned to 50.0.2 in Superset
locked requirements.
* `GHSA-j586-36cw-2gc2`: Explicitly excluded from `.trivyignore`
recommendations, guiding operators to upgrade to `msgpack>=1.2.3` instead.
3. **Reverted superset/utils/core.py Fallback**:
Dropped the redundant `TypeError` retry in `parse_ssl_cert` as
`cryptography>=50.0.2,<51` already supports single-argument
`load_pem_x509_certificate(data)` reliably across all supported environments.
4. **Lockfile & Compilation Verification**:
Confirmed that `requirements/base.txt` on `master` is already pinned to
`cryptography==50.0.2`, `msgpack==1.2.3`, and `pyarrow==25.0.1`. Updating the
specification files (`requirements/base.in` and `superset-core/pyproject.toml`)
closes the resolver gap for downstream builds without requiring changes to the
locked base file.
5. **Test Verification**:
* `pytest tests/unit_tests/db_engine_specs/test_snowflake.py`: 45 passed
in 1.88s.
* Rebased cleanly onto latest `upstream/master`, mergeable state is
`MERGEABLE`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
