vrkommaraju commented on issue #45087: URL: https://github.com/apache/superset/issues/45087#issuecomment-6123269157
Dear @FrancescoCastaldi Thank you very much for the detailed and prompt response. The explanation regarding the actual usage of cryptography, msgpack, and pyarrow within Superset, along with the assessment of their exploitability in standard deployments, is extremely helpful. We also appreciate the recommended mitigation options, particularly the guidance on custom container layering and the use of Trivy suppression with proper justification where the vulnerable code paths are not practically reachable in Superset deployments. It is especially encouraging to see that a fix has already been submitted in PR #45186 to widen the dependency ranges and address the reported vulnerabilities. We will review the proposed changes and evaluate the recommended workaround in the meantime. Thank you again for the quick turnaround, the thorough technical analysis, and the effort put into providing both short-term mitigations and a long-term resolution. Much appreciated. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
