[Security] Published image has 17 Critical dependency vulnerabilities, most with fixes available

Open
  • Is something wrong?
#89 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
52/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
django, docker, python
Domain
devops, security

Research direction

The pins live in app/requirements.txt, the runtime stage of app/Dockerfile installs Debian packages, and .dockerignore decides whether requirements-dev.txt ships in the image. Start by checking that the proposed pins resolve together with pip install --dry-run on python:3.11-slim, and settle the Django target (5.2.13 or 5.2.18) with a maintainer. Done means the pins resolve, pip check is clean, and the project's own test suite passes on the new versions.

Written by the indexing model from the issue text.

Description

(Sorry, written by Claude, amended by me!)

Summary

Amazon Inspector scans of the published image report 15 CRITICAL and 44 HIGH findings in Python packages. Every one has a fixed release, and the fixes below resolve together on the image's Python 3.11 (Debian 12).

Scanned image: brainthee/chaotica:latest, built from b7c4f6c. Index sha256:b10a69bb…80d4e7, linux/amd64 manifest sha256:70d5baf8…e4ad5f.

Debian packages and dev-only files are covered in separate issues (#02, #03).

CRITICAL

Package Current Fixed in Findings Public exploit
pillow 11.2.1 13.0.0 CVE-2026-112393, CVE-2026-112398, CVE-2026-112900, CVE-2026-112403, CVE-2026-96639, CVE-2026-54058 5 of 6
PyJWT 2.10.1 2.14.0 CVE-2026-102268, CVE-2026-102267 1 of 2
Django 5.2.12 5.2.13 (current 5.2 LTS: 5.2.18) CVE-2026-4277 No
cryptography 45.0.4 46.0.7 CVE-2026-39892 No
pyOpenSSL (transitive) 25.1.0 26.0.0 CVE-2026-27459 No
aiohttp 3.12.13 3.13.4 CVE-2026-34520 No
fonttools 4.58.4 4.60.2 CVE-2025-66034 Yes
certifi 2025.6.15 2026.10.18 GHSA-6q48-6c7w-9gw2 No

Django: Inspector reports the fix as 6.0.4, but Django 6.0 needs Python 3.12 and Debian 12 ships 3.11. Django 5.2.13 came out the same day as 6.0.4, so it should carry the same security fix. Staying on the 5.2 LTS line is the low-risk option.

HIGH

Package Current Fixed in Findings
aiohttp 3.12.13 3.14.4 CVE-2026-34993, CVE-2026-47265, CVE-2026-50269, CVE-2026-54273, CVE-2026-54274, CVE-2026-54275, CVE-2026-54277, CVE-2026-54278, CVE-2026-54279, CVE-2026-54280, CVE-2026-69244, CVE-2026-111064, CVE-2026-111066, GHSA-2g87-pp6c-29x5
cryptography 45.0.4 50.0.0 GHSA-537c-gmf6-5ccf (48.0.1), CVE-2026-69249 (49.0.0), CVE-2026-69247 (50.0.0)
urllib3 (transitive) 2.5.0 2.8.0 CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-97687, CVE-2026-97689
Twisted (transitive, via daphne) 25.5.0 26.10.0 CVE-2026-42304, CVE-2026-115775, CVE-2026-115776, CVE-2026-115778, GHSA-vpp8-g58w-m8mp
sqlparse 0.5.3 0.6.0 CVE-2026-54284, CVE-2026-59893, CVE-2026-71491
djangorestframework 3.16.0 3.18.2 CVE-2026-114136, CVE-2026-114137, CVE-2026-114138
PyJWT 2.10.1 2.15.0 CVE-2026-101918, CVE-2026-102275
soupsieve 2.7 2.8.4 CVE-2026-49476, CVE-2026-49477
lxml 5.4.0 6.1.0 CVE-2026-41066
daphne 4.1.2 4.2.2 CVE-2026-44545
pyasn1 (transitive) 0.6.4 0.6.5 CVE-2026-119194, CVE-2026-119195, CVE-2026-119196, CVE-2026-119197
jaraco.context (vendored in setuptools 80.9.0) 5.3.0 6.1.0 CVE-2026-23949

Notes:

  • Twisted: Inspector lists 26.10.0rc1 as the fix for three of these. The final 26.10.0 release is available and includes it.
  • cryptography 50 and pyOpenSSL: cryptography 50 needs pyOpenSSL 26.4.0, which requires cryptography>=49,<51.
  • soupsieve: 4.x needs Python 3.11.5 or newer, and Debian 12 ships 3.11.2, so stay on 2.8.x.
  • jaraco.context: this is the copy vendored inside setuptools. setuptools 80.10.2 vendors 6.1.0 and still ships pkg_resources. 81 and later may drop pkg_resources.

Suggested fix: app/requirements.txt

aiosignal, cffi, yarl and zope.interface move as a consequence of the upgrades above.

-aiohttp==3.12.13
-aiosignal==1.3.2
+aiohttp==3.14.4
+aiosignal==1.4.0
-certifi==2025.6.15
-cffi==1.17.1
+certifi==2026.10.18
+cffi==2.1.1
-cryptography==45.0.4
+cryptography==50.0.0
-daphne==4.1.2
+daphne==4.2.2
-Django==5.2.12
+Django==5.2.18
-djangorestframework==3.16.0
+djangorestframework==3.18.2
-fonttools==4.58.4
+fonttools==4.60.2
-lxml==5.4.0
+lxml==6.1.0
-pillow==11.2.1
+pillow==13.0.0
-PyJWT==2.10.1
+PyJWT==2.15.0
-soupsieve==2.7
+soupsieve==2.8.4
-sqlparse==0.5.3
+sqlparse==0.6.0
-urllib3==2.5.0
+urllib3==2.8.0
-yarl==1.20.1
+yarl==1.25.1
-zope.interface==7.2
+zope.interface==8.7
+pyasn1>=0.6.5
+pyOpenSSL>=26.4.0
+setuptools>=80.10.2,<81
+Twisted>=26.10.0

The last four aren't pinned today, so they need a floor (or a constraints file) to stop the resolver choosing a vulnerable version.

Separately, multidict==6.5.0 has been yanked on PyPI for a regression in md.update(). 6.5.1 is the smallest non-yanked bump.

How we checked

  • Base image: we layered the upgrades onto sha256:70d5baf8….
  • Result: every package installed at its fixed version. pip check reports no broken requirements, all the affected modules import, and python3 manage.py check reports no issues.
  • Pillow 13: an open, thumbnail and save smoke test (PNG, JPEG, WebP and GIF) passed.
  • Not run: we haven't run the project's own test suite against these versions.
Dominant language
HTML
Stars
6
Forks
4
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from brainthee/CHAOTICA

All issues in brainthee/CHAOTICA

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.