Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Cherry pick][RHOAIENG-15961] Fix Starlette Denial of service (DoS) via multipart/form-data (#4006) #735

Merged
merged 2 commits into from
Dec 12, 2024

Conversation

hdefazio
Copy link

@hdefazio hdefazio commented Dec 10, 2024

chore: Fix CVE-2024-47874

Cherry-picks kserve#4006

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Type of changes
Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Feature/Issue validation/testing:

Please describe the tests that you ran to verify your changes and relevant result summary. Provide instructions so it can be reproduced.
Please also list any relevant details for your test configuration.

  • Test A

  • Test B

  • Logs

Special notes for your reviewer:

  1. Please confirm that if this PR changes any image versions, then that's the sole change this PR makes.

Checklist:

  • Have you added unit/e2e tests that prove your fix is effective or that this feature works?
  • Has code been commented, particularly in hard-to-understand areas?
  • Have you made corresponding changes to the documentation?

Release note:


Re-running failed tests

  • /rerun-all - rerun all failed workflows.
  • /rerun-workflow <workflow name> - rerun a specific failed workflow. Only one workflow name can be specified. Multiple /rerun-workflow commands are allowed per comment.

@spolti
Copy link

spolti commented Dec 11, 2024

@hdefazio can you please open a jira for this?

Copy link

@spolti spolti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also you might need to run poetry lock --no-update to fix the storage-initializer build, it can be verified locally by building the container.

@hdefazio
Copy link
Author

Yes - there is already a JIRA for this: RHOAIENG-14604

@hdefazio hdefazio requested a review from spolti December 11, 2024 17:00
@spolti spolti changed the title [Cherry pick] Fix Starlette Denial of service (DoS) via multipart/form-data (#4006) [Cherry pick][RHOAIENG-14604] Fix Starlette Denial of service (DoS) via multipart/form-data (#4006) Dec 11, 2024
@openshift-ci openshift-ci bot added the lgtm label Dec 12, 2024
Copy link

openshift-ci bot commented Dec 12, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hdefazio, spolti

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@spolti spolti merged commit 353ced9 into red-hat-data-services:rhoai-2.16 Dec 12, 2024
15 of 17 checks passed
@spolti
Copy link

spolti commented Dec 12, 2024

Yes - there is already a JIRA for this: RHOAIENG-14604

Isn't this one:? https://issues.redhat.com/browse/RHOAIENG-15961

@spolti spolti changed the title [Cherry pick][RHOAIENG-14604] Fix Starlette Denial of service (DoS) via multipart/form-data (#4006) [Cherry pick][RHOAIENG-15961] Fix Starlette Denial of service (DoS) via multipart/form-data (#4006) Dec 12, 2024
@hdefazio
Copy link
Author

Oops yes - I copied the wrong link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants