FrancescoCastaldi commented on issue #45087:
URL: https://github.com/apache/superset/issues/45087#issuecomment-6108010332
Hi @vrkommaraju,
Thank you for the detailed report and Trivy reproduction details.
Regarding the four questions raised in the issue:
1. Applicability and exploitability in Apache Superset:
* cryptography (CVE-2026-69247, CVE-2026-69249, GHSA-537c-gmf6-5ccf,
CVE-2026-69248): Cryptography is used primarily for encrypting database
connection secrets at rest and parsing administrator-configured SSL
certificates. Unauthenticated input never reaches PKCS12 parsing routines.
Exploitability in standard deployments is considered low risk.
* msgpack (GHSA-6v7p-g79w-8964): Used exclusively for caching SQL Lab query
results (`RESULTS_BACKEND_USE_MSGPACK`). The serialized byte streams are
written and read strictly within the trusted internal Redis/cache boundary.
Exploitation requires prior full compromise of the internal caching
infrastructure.
* pyarrow (CVE-2026-25087): Used for IPC serialization and dataset
exploration in analytical pipelines.
2. Recommended mitigations and workarounds:
* Container extension: Operators running existing 6.1.0 images can layer
remediated packages in a custom Dockerfile:
`RUN pip install --no-cache-dir "cryptography>=50.0.2" "msgpack>=1.2.3"
"pyarrow>=25.0.1"`
* Compliance scanner triage: For automated CI compliance gates, findings
where the code path is unreachable can be suppressed in `.trivyignore`
referencing issue #45087.
Full documentation is published in
`docs/admin_docs/security/dependency-vulnerability-remediation.mdx`.
3. Roadmap and dependency constraint resolution:
We have submitted a complete fix in PR #45186:
* `cryptography`: Widened to `>=48.0.1, <51.0.0`, allowing 48.0.1+, 49.0.0,
50.0.0, and 50.0.2 without resolver conflicts.
* `msgpack`: Widened to `>=1.2.1, <1.3`, allowing 1.2.1+ and 1.2.3.
* `pyarrow`: Floor elevated to `>=25.0.1, <26` across root and superset-core.
* Verified Snowflake keypair private key serialization, SQL Lab msgpack
serialization, PyArrow IPC streams, and automated CI audit scripts
(`scripts/check_security_dependencies.py`).
4. Scanner triage status:
The upstream library vulnerabilities are genuine, but represent
defense-in-depth hygiene rather than direct unauthenticated remote exploit
vectors in Superset.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
