CVE-2023-29159

Advisory

Mlrun 1.4.0rc15 updates its dependency 'fastapi' to version '0.95.2' to include a security fix.
https://github.com/mlrun/mlrun/pull/3791/

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Features / Enhancements
* **Events**: Add support to audit secret actions to iguazio, 3711, tankilevitch
* **Feature Store**: Get-offline: enforce param `entity_timestamp_column` to be spcified only with param `entity_rows`, 3786, davesh0812
* **Build**: Bump alpine to 3.18, 3794, liranbg
* **System Tests**: Clear custom project names to delete after deletion, 3793, alonmr
* **Serving**: Add missing explain method, 3656, yanburman
* **KFP**: Align pipelines output with mlrun conventions, 3784, liranbg
* **CI**: Update dev_utilities, 3780, eliyahu77
* **Scaling**: Tune auto-scaling details, 3782, george0st
* **UI**: [Features & enhancement](https://github.com/mlrun/ui/releases/tag/v1.4.0-rc15#features-and-enhancements)

Bug fixes
* **Requirements**: Bump fastapi to fix security vulnerability, 3791, alonmr
* **Datastore**: Fix time zone error, 3788, gtopper
* **Spark**: Fix storing multiple keys from a spark dataframe into redis, 3789, alxtkr77
* **Serving**: Fix response for readiness status, 3776, Eyal-Danieli
* **CI**: Fix missing underscore when verifying run outputs, 3783, liranbg
* **Projects**: Fix no iteration parameter in `get_artifact_uri` method, 3775, quaark
* **UI**: [Bug fixes](https://github.com/mlrun/ui/releases/tag/v1.4.0-rc15#bug-fixes)


Pull requests:
ca091a4a [Events] Add support to audit secret actions to Iguazio (3711)
e21127f7 [Feature Store] get-offline: Enforce param `entity_timestamp_column` to be spcified only with param `entity_rows` (3786)
2ed6c0a0 [Build] Bump alpine to 3.18 (3794)
6df3a01b [System Tests] Clear custom project names to delete after deletion (3793)
afc3f0d6 [Serving] Add missing explain method (3656)
7f44e906 [Requirements] Bump fastapi to fix security vulnerability (3791)
749e2fea [Datastore] Fix time zone error (3788)
4623a675 [Spark] Fix storing multiple keys from a Spark dataframe into Redis (3789)
34974300 [Serving] Fix response for readiness status (3776)
c4bdf092 [KFP] Align pipelines output with mlrun conventions (3784)
811c1646 [CI] Update dev_utilities (3780)
02ef829f [CI] Fix missing underscore when verifying run outputs (3783)
30b5a29c [Projects] Fix no iteration parameter in `get_artifact_uri` method (3775)
d3fde657 [Scaling] Tune auto-scaling details (3782)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29159