promptflow icon indicating copy to clipboard operation
promptflow copied to clipboard
verified publisher icon microsoft

[Snyk] Fix for 20 vulnerabilities

Open zzn2 opened this issue 1 year ago • 0 comments

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `pip` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • examples/flows/standard/customer-intent-extraction/requirements.txt
⚠️ Warning 
langchain 0.0.27 requires numpy, which is not installed.

Vulnerabilities that will be fixed

By pinning:
Severity Issue Breaking Change Exploit Maturity
critical severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5411357		 No Proof of Concept
high severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5710354		 No Proof of Concept
critical severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5725807		 No Proof of Concept
critical severity Arbitrary Code Injection
SNYK-PYTHON-LANGCHAIN-5752409		 No Proof of Concept
critical severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5759265		 No Proof of Concept
high severity SQL Injection
SNYK-PYTHON-LANGCHAIN-5759268		 No Proof of Concept
critical severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5821403		 No No Known Exploit
medium severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5843451		 No Proof of Concept
medium severity Arbitrary Command Injection
SNYK-PYTHON-LANGCHAIN-5843452		 No Proof of Concept
high severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5843727		 No Proof of Concept
critical severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5850009		 No Proof of Concept
critical severity Arbitrary Code Execution
SNYK-PYTHON-LANGCHAIN-5880430		 No Proof of Concept
medium severity Server-side Request Forgery (SSRF)
SNYK-PYTHON-LANGCHAIN-6008967		 No No Known Exploit
high severity SQL Injection
SNYK-PYTHON-LANGCHAIN-6026731		 No Proof of Concept
medium severity Server-Side Request Forgery
SNYK-PYTHON-LANGCHAIN-6026732		 No Proof of Concept
critical severity Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
SNYK-PYTHON-LANGCHAIN-6041516		 No Proof of Concept
medium severity Path Traversal
SNYK-PYTHON-LANGCHAIN-6615703		 No Proof of Concept
low severity NULL Pointer Dereference
SNYK-PYTHON-NUMPY-2321964		 No Proof of Concept
low severity Buffer Overflow
SNYK-PYTHON-NUMPY-2321966		 No No Known Exploit
low severity Denial of Service (DoS)
SNYK-PYTHON-NUMPY-2321970		 No Proof of Concept

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"langchain","from":"0.0.27","to":"0.0.353"},{"name":"numpy","from":"1.21.3","to":"1.22.2"}],"env":"prod","issuesToFix":[{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5411357","severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5710354","severity":"high","title":"Arbitrary Code Execution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5725807","severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5752409","severity":"critical","title":"Arbitrary Code Injection"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5759265","severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5759268","severity":"high","title":"SQL Injection"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-LANGCHAIN-5821403","severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5843451","severity":"medium","title":"Arbitrary Code Execution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5843452","severity":"medium","title":"Arbitrary Command Injection"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5843727","severity":"high","title":"Arbitrary Code Execution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5850009","severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-5880430","severity":"critical","title":"Arbitrary Code Execution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-LANGCHAIN-6008967","severity":"medium","title":"Server-side Request Forgery (SSRF)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-6026731","severity":"high","title":"SQL Injection"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-6026732","severity":"medium","title":"Server-Side Request Forgery"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-6041516","severity":"critical","title":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-LANGCHAIN-6615703","severity":"medium","title":"Path Traversal"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-NUMPY-2321964","severity":"low","title":"NULL Pointer Dereference"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-NUMPY-2321966","severity":"low","title":"Buffer Overflow"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-NUMPY-2321970","severity":"low","title":"Denial of Service (DoS)"}],"prId":"add5b7d3-94eb-4157-854e-f4a56328e74c","prPublicId":"add5b7d3-94eb-4157-854e-f4a56328e74c","packageManager":"pip","priorityScoreList":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"projectPublicId":"bdb547e2-542f-434f-8362-9793aad2f51c","projectUrl":"https://app.snyk.io/org/zzn2/project/bdb547e2-542f-434f-8362-9793aad2f51c?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["pr-warning-shown"],"type":"auto","upgrade":[],"vulns":["SNYK-PYTHON-LANGCHAIN-5411357","SNYK-PYTHON-LANGCHAIN-5710354","SNYK-PYTHON-LANGCHAIN-5725807","SNYK-PYTHON-LANGCHAIN-5752409","SNYK-PYTHON-LANGCHAIN-5759265","SNYK-PYTHON-LANGCHAIN-5759268","SNYK-PYTHON-LANGCHAIN-5821403","SNYK-PYTHON-LANGCHAIN-5843451","SNYK-PYTHON-LANGCHAIN-5843452","SNYK-PYTHON-LANGCHAIN-5843727","SNYK-PYTHON-LANGCHAIN-5850009","SNYK-PYTHON-LANGCHAIN-5880430","SNYK-PYTHON-LANGCHAIN-6008967","SNYK-PYTHON-LANGCHAIN-6026731","SNYK-PYTHON-LANGCHAIN-6026732","SNYK-PYTHON-LANGCHAIN-6041516","SNYK-PYTHON-LANGCHAIN-6615703","SNYK-PYTHON-NUMPY-2321964","SNYK-PYTHON-NUMPY-2321966","SNYK-PYTHON-NUMPY-2321970"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Execution 🦉 SQL Injection 🦉 Server-side Request Forgery (SSRF) 🦉 More lessons are available in Snyk Learn

zzn2 avatar May 17 '24 21:05 zzn2