CVE-2022-40897

Advisory

Mtr2mqtt 0.5.1 upgrades Python Packaging Authority (PyPA) on its Dockerfile to fix the vulnerability CVE-2022-40897 in the base image.
https://github.com/tvallas/mtr2mqtt/commit/d2be9863485535d1c9ce2e493b1a00cc62bfe877#diff-dd2c0eb6ea5cfc6c4bd4eac30934e2d5746747af48fef6da689e85b752f39557R6

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Fix

* fix: update packages with vulnerabilities (34)

* fix: update packages with vulnerabilities

* ci: remove exact python version from lint and test on push job as referred version is unavailable

* ci: make trivy scan workflow use python 3.8

* ci: explicitly set the python-semantic-release version to 7.x as the 8 version has breaking changes

The version 8 seems to have missing option to print current version using command `print-version`

* fix: update vulnerable package in docker image ([`d2be986`](https://github.com/tvallas/mtr2mqtt/commit/d2be9863485535d1c9ce2e493b1a00cc62bfe877))

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40897