CVE-2019-1010266

Advisory

Polyaxon 0.4.1 updates its NPM dependency 'lodash' to v4.17.11 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* Add UI for experiment jobs (overview, logs, statuses).
* Improve logging and logs archiving of distributed experiments.
* Improve the header's tooltip behaviour.
* Improve experiment UI by reducing number of tabs.
* Improve a couple of queries resulting in large memory consumption.
* Improve CI sync function to handle:
* Updating access tokens.
* Force push mechanism.
* Fetching of new branches
* Fix build branch and commit handling, remove `ref` and add a more explicit fields: `commit` and `branch`.
* Fix regression in distributed experiments.
* Fix an issue with experiment job's statuses creation dates.
* Fix readme editor styles.
* Fix charts UI adjustment.
* Fix issue scheduling notebook on TPU.
* Fix some issues related to corrupted UI state resulting in UI crashing.
* Update dependencies exposing security vulnerabilities.
* Update several libraries to newer and stable versions.

Resources

• https://pypi.org/project/polyaxon
• https://pyup.io/changelogs/polyaxon/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266