GitHub user FrancescoCastaldi added a comment to the discussion: Superset 6.1:
is flask-caching still structurally required when runtime uses NullCache and
SupersetMetastoreCache?
To address your questions directly regarding Superset 6.1.0 dependency
architecture:
### 1. Is `flask-caching` structurally required?
Yes. `flask-caching` is an integral architectural dependency of Apache
Superset. Even when you configure `NullCache` or `SupersetMetastoreCache`:
- `SupersetCache` directly inherits from `flask_caching.Cache`
(`superset/utils/cache_manager.py`).
- `SupersetMetastoreCache` inherits from `flask_caching.base.BaseCache`
(`superset/extensions/metastore_cache.py`).
Removing `flask-caching` from the Python environment causes immediate
`ModuleNotFoundError` exceptions during application startup (`superset/app.py`).
### 2. Security Assessment and False Positive Resolution (CVE-2021-33026)
The block in your private mirror for `flask-caching` 2.x releases based on
CVE-2021-33026 is a scanner false positive:
- **Official Range:** Both the GitHub Advisory Database (GHSA-656c-6cxf-hvcv)
and the National Vulnerability Database (NVD) specify that CVE-2021-33026
affects only versions `<= 1.10.1`.
- **Superset 6.1.0 Pin:** Superset 6.1.0 pins `flask-caching==2.3.1`, which is
completely outside the affected version range.
- **Deserialization Safety:** To eliminate pickle deserialization risks
entirely, ensure your `SupersetMetastoreCache` configurations explicitly
specify `JsonKeyValueCodec`:
```python
from superset.key_value.types import JsonKeyValueCodec
FILTER_STATE_CACHE_CONFIG = {
"CACHE_TYPE": "SupersetMetastoreCache",
"CACHE_DEFAULT_TIMEOUT": 7776000,
"REFRESH_TIMEOUT_ON_RETRIEVAL": True,
"CODEC": JsonKeyValueCodec(),
}
EXPLORE_FORM_DATA_CACHE_CONFIG = {
"CACHE_TYPE": "SupersetMetastoreCache",
"CACHE_DEFAULT_TIMEOUT": 7776000,
"REFRESH_TIMEOUT_ON_RETRIEVAL": True,
"CODEC": JsonKeyValueCodec(),
}
```
### 3. Recommended Remediation
Submit a security exception to your package mirror administrators referencing
GHSA-656c-6cxf-hvcv to allowlist `flask-caching==2.3.1`. This allows the
standard Superset 6.1.0 container build to complete cleanly without modifying
the core caching architecture.
GitHub link:
https://github.com/apache/superset/discussions/44823#discussioncomment-19164451
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
