codeant-ai-for-open-source[bot] commented on code in PR #45186:
URL: https://github.com/apache/superset/pull/45186#discussion_r4242299365
##########
docs/admin_docs/security/dependency-vulnerability-remediation.mdx:
##########
@@ -0,0 +1,77 @@
+---
+title: Dependency Vulnerability Remediation & Scanner Guidance
+sidebar_position: 3
+---
+
+# Dependency Vulnerability Remediation & Container Scanner Guidance
+
+This guide addresses third-party dependency vulnerabilities reported by
container security scanners (such as Trivy, Grype, and Snyk) in Apache Superset
environments, specifically regarding dependency constraint handling for
cryptography, msgpack, and pyarrow (referencing issue #45087).
+
+## 1. Vulnerability Applicability & Risk Assessment
+
+When security scanners evaluate Apache Superset container images, findings
frequently arise in transitive or pinned direct dependencies. The table below
details the applicability and actual exploitability surface of recently
reported findings:
+
+| Package | Finding ID | Severity | Remediation Floor | Superset Code Path &
Exploitability Analysis |
+| :--- | :--- | :--- | :--- | :--- |
+| **cryptography** | CVE-2026-69247, CVE-2026-69249, GHSA-537c-gmf6-5ccf,
CVE-2026-69248 | HIGH / MEDIUM | `>=48.0.1` (resolved in `50.0.2`) | Used
primarily for encrypting database connection passwords at rest and parsing
operator-supplied SSL certificates. Unauthenticated external input does not
traverse PKCS12 parsing routines. Exploitability in standard deployments is
considered low. |
+| **msgpack** | GHSA-6v7p-g79w-8964 | HIGH | `>=1.2.1` (resolved in `1.2.3`) |
Utilized internally for SQL Lab asynchronous query result serialization
(`RESULTS_BACKEND_USE_MSGPACK`). Raw msgpack byte streams are generated and
consumed only within the trusted backend cache boundary. Exploitability
requires full cache store compromise. |
+| **pyarrow** | CVE-2026-25087 | HIGH | `>=23.0.1` (resolved in `25.0.1`) |
Used for columnar tabular transformations and CSV/Parquet ingestion by
authenticated users. Ingestion pathways are governed by role-based permissions
and file size limits. Exploitability is bounded to authorized data uploads. |
Review Comment:
✅ **CodeAnt verified this suggestion was addressed in subsequent commits and
marked this thread resolved** as of `5759859`.
The guide now lists `>=25.0.1` as the remediation floor for CVE-2026-25087,
matching the package constraints.
<sub>If that's not right, unresolve this thread and CodeAnt will leave it
open.</sub>
<!-- codeant-auto-resolve-reply -->
##########
pyproject.toml:
##########
@@ -50,7 +50,7 @@ dependencies = [
"flask-cors>=6.0.5, <7.0",
"croniter>=6.2.4",
"cron-descriptor",
- "cryptography>=50.0.2, <51.0.0",
+ "cryptography>=48.0.1, <51.0.0",
Review Comment:
✅ **CodeAnt verified this suggestion was addressed in subsequent commits and
marked this thread resolved** as of `5759859`.
The cryptography dependency now requires `>=50.0.2, <51.0.0`, excluding
releases below the stated remediation floor.
<sub>If that's not right, unresolve this thread and CodeAnt will leave it
open.</sub>
<!-- codeant-auto-resolve-reply -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
