rusackas opened a new pull request, #44124: URL: https://github.com/apache/superset/pull/44124
### SUMMARY Follow-up to #44035 (which restored container-image vulnerability scanning after #38780 removed the compromised Trivy setup). Its first real scan against `master` surfaced the alerts at https://github.com/apache/superset/security/code-scanning?query=is%3Aopen+branch%3Amaster+severity%3Acritical, which break down into two unrelated issues: **1. Grype self-match false positives (4 of the 6 critical alerts).** The built image bundles this project's own dev build as the `apache-superset` package, installed from source with version `0.0.0.dev0` rather than a real released version. Grype can't compare that placeholder against a fixed-version threshold, so it treats every historical `apache-superset` GHSA ever published as still unfixed. I confirmed this locally: scanning this exact package metadata (`apache_superset-0.0.0.dev0.dist-info`) directly with Grype returns **61 matches**, spanning every severity up to Critical — including the three flagged here (`GHSA-92qf-8gh3-gwcm`, `GHSA-rwhh-6x83-84v6`, `GHSA-wh73-hpcg-v32j`), patched in 4.1.0 (Dec 2024), 3.0.3 (Jan 2024), and 1.4.2 (2022) respectively. Obviously not still open on current `master`. Added `.grype.yaml` excluding the paths where that self-referential package metadata lives inside the image. Verified locally against a real `site-packages` directory containing several packages: with the exclude, `apache-superset` matches drop from 61 to 0, while the 7 real findings from 4 *other* packages in the same directory are untouched — so this isn't a blanket suppression, just the self-match. **2. `CVE-2026-6100-python` — a real, currently open finding.** The base image pins `python 3.11.14-slim-trixie` (`Dockerfile` `ARG PY_VER`), vulnerable to a use-after-free in `lzma`/`bz2`/`gzip` decompressor reuse after a `MemoryError`. Fixed in `3.11.16` (confirmed the `python:3.11.16-slim-trixie` tag exists on Docker Hub, published 2026-09-02). Bumped all three places this version is pinned in lockstep, since they have to agree or `pyver-override-check` fails: - `Dockerfile`'s `ARG PY_VER` default - `scripts/docker-build-extra-flags.sh`'s override applied to every preset except `py311`/`py312` - `.github/workflows/docker.yml`'s `pyver-override-check` job, which asserts the effective `--build-arg PY_VER` value ### TESTING INSTRUCTIONS - `.grype.yaml`: verified with the real `grype` CLI (not just schema validation) — scanning a directory containing this project's own `apache_superset-0.0.0.dev0.dist-info` plus several real third-party packages, before/after the exclude: | | total matches | apache-superset matches | other packages' matches | |---|---|---|---| | before | 68 | 61 | 7 (jaraco-context, paramiko, pytest, python-multipart) | | after | 7 | 0 | 7 (unchanged) | - Confirmed Grype auto-discovers `.grype.yaml` from its working directory with no `--config` flag needed (matching how `anchore/scan-action` runs, from the repo checkout root) — no workflow change needed beyond adding the file. - `bash scripts/docker-build-extra-flags.sh lean dummy-tag` → `--build-arg PY_VER=3.11.16-slim-trixie ...`; `py311`/`py312` presets unaffected (no PY_VER override, as before). - `action-validator` and `zizmor` clean on `docker.yml` (same 5 pre-existing, unrelated `self-repository` nits as before). ### ADDITIONAL INFORMATION - [x] Has associated issue: fixes the critical alerts at the code-scanning query linked above - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
