fix vulnerabilities (#2750)

fix CVE-2024-53908, CVE-2024-53907, update Docker debian image
onaio · Dec 19, 2024 · 68c8eab · 68c8eab
1 parent e800b13
commit 68c8eab
Show file tree

Hide file tree

Showing 10 changed files with 11 additions and 11 deletions.
diff --git a/docker/onadata-uwsgi/Dockerfile.ubuntu b/docker/onadata-uwsgi/Dockerfile.ubuntu
@@ -58,7 +58,7 @@ RUN python -m pip install --no-cache-dir -r requirements/docs.pip && \
     make -C docs html
 
 
-FROM debian:bookworm-20241016 as runtime
+FROM debian:bookworm-20241202 as runtime
 
 ENV DEBIAN_FRONTEND=noninteractive
 

diff --git a/requirements/azure.in b/requirements/azure.in
@@ -1,3 +1,3 @@
 cryptography>=43.0.1
-django>=4.2.16,<5
+django>=4.2.17,<5
 django-storages[azure]
diff --git a/requirements/azure.pip b/requirements/azure.pip
@@ -22,7 +22,7 @@ cryptography==43.0.1
     # via
     #   -r requirements/azure.in
     #   azure-storage-blob
-django==4.2.16
+django==4.2.17
     # via
     #   -r requirements/azure.in
     #   django-storages

diff --git a/requirements/base.pip b/requirements/base.pip
@@ -86,7 +86,7 @@ deprecated==1.2.14
     # via onadata
 dict2xml==1.7.5
     # via onadata
-django==4.2.16
+django==4.2.17
     # via
     #   django-activity-stream
     #   django-cors-headers

diff --git a/requirements/dev.pip b/requirements/dev.pip
@@ -76,7 +76,7 @@ click-plugins==1.1.1
     # via celery
 click-repl==0.3.0
     # via celery
-cryptography==42.0.8
+cryptography==43.0.1
     # via
     #   jwcrypto
     #   onadata
@@ -104,7 +104,7 @@ dill==0.3.8
     # via pylint
 distlib==0.3.8
     # via virtualenv
-django==4.2.16
+django==4.2.17
     # via
     #   django-activity-stream
     #   django-cors-headers

diff --git a/requirements/s3.in b/requirements/s3.in
@@ -1,3 +1,3 @@
 boto3
-django>=4.2.16,<5
+django>=4.2.17,<5
 django-storages
diff --git a/requirements/s3.pip b/requirements/s3.pip
@@ -12,7 +12,7 @@ botocore==1.34.134
     # via
     #   boto3
     #   s3transfer
-django==4.2.16
+django==4.2.17
     # via
     #   -r requirements/s3.in
     #   django-storages

diff --git a/requirements/ses.in b/requirements/ses.in
@@ -1,3 +1,3 @@
 boto
-django>=4.2.16,<5
+django>=4.2.17,<5
 django-ses
diff --git a/requirements/ses.pip b/requirements/ses.pip
@@ -14,7 +14,7 @@ botocore==1.34.134
     # via
     #   boto3
     #   s3transfer
-django==4.2.16
+django==4.2.17
     # via
     #   -r requirements/ses.in
     #   django-ses

diff --git a/setup.cfg b/setup.cfg
@@ -27,7 +27,7 @@ tests_require =
     httmock
     requests-mock
 install_requires =
-    Django>=4.2.16,<5
+    Django>=4.2.17,<5
     django-guardian
     django-registration-redux
     django-templated-email