Repository navigation
Addressing CVE-2022-40897 Vulnerability in Python 3.11.9-alpine3.19 Docker Image #919
Description
We have identified that our Docker image is affected by the CVE-2022-40897 vulnerability. This vulnerability allows remote attackers to execute arbitrary code or cause of DOS via a crafted image file, leading to potential system compromise or disruption.
Could you please provide an estimated timeline for fixing this issue? Additionally, any guidance on how to address this vulnerability effectively would be highly appreciated.? We would like to ensure that our system remains secure and up-to-date.
Thank you.
Activity
yosifkit commentedon Apr 17, 2024
We explicitly already updated
setuptoolsfor this CVE in python 3.10, 3.11, and 3.12 images (#781 ->#783), so the scanner is incorrect.tianon commentedon Apr 17, 2024
Uhhhh, what? If this is exploitable in your application, that would mean you're importing
setuptoolsinto your application, which seems highly unusual. The only other alternative I can think of is that you're perhaps running untrusted images, which is already "arbitrary code" so I fail to see how this increases the surface area of attack in any appreciable way?