CVE-2023-34540

Advisory

Langchain 0.0.225 includes a fix for an arbitrary code execution vulnerability in JIRA API wrapper.
https://github.com/hwchase17/langchain/pull/6992
https://github.com/hwchase17/langchain/issues/4833

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* Add pg_hnsw vectorstore integration by raoufchebri in https://github.com/hwchase17/langchain/pull/6893
* add tqdm to embeddings by hwchase17 in https://github.com/hwchase17/langchain/pull/7205
* add token max parameter by hwchase17 in https://github.com/hwchase17/langchain/pull/7204
* fix: missing parameter in POST/PUT/PATCH HTTP requests by nirga in https://github.com/hwchase17/langchain/pull/7194
* fix: rename the invalid function name of GoogleSerperResults Tool for OpenAIFunctionCall by Sukitly in https://github.com/hwchase17/langchain/pull/7176
* Fixed typos in MongoDB Atlas Vector Search documentation by prakul in https://github.com/hwchase17/langchain/pull/7174
* Update in_memory.py to fix "TypeError: keywords must be strings" by langabi in https://github.com/hwchase17/langchain/pull/7202
* Support for SPARQL by felixocker in https://github.com/hwchase17/langchain/pull/7165
* fix: prevent adding an empty string to the result queue in AsyncIteratorCallbackHandler by Sukitly in https://github.com/hwchase17/langchain/pull/7180
* Replace stop clause with shorter, pythonic alternative by serhatgktp in https://github.com/hwchase17/langchain/pull/7159
* Add serialized object to retriever start callback by nfcampos in https://github.com/hwchase17/langchain/pull/7074
* Added documentation for add_texts function for Pinecone integration by conboy in https://github.com/hwchase17/langchain/pull/7134
* make textstat optional in the flyte callback handler by samhita-alla in https://github.com/hwchase17/langchain/pull/7186
* Remove extra base model by nfcampos in https://github.com/hwchase17/langchain/pull/7213
* fix: Chroma filter symbols not supporting LIKE and CONTAIN by why8023 in https://github.com/hwchase17/langchain/pull/7169
* Jinja2 validation changed to issue warnings rather than issuing exceptions. by keenborder786 in https://github.com/hwchase17/langchain/pull/7161
* Fix steamship import error by hseung578 in https://github.com/hwchase17/langchain/pull/7133
* add trulens integration by joshreini1 in https://github.com/hwchase17/langchain/pull/7096
* support adding custom metadata to runs by agola11 in https://github.com/hwchase17/langchain/pull/7120
* Mark some output parsers as serializable (cross-checked w/ JS) by nfcampos in https://github.com/hwchase17/langchain/pull/7083
* Retryable exception for empty OpenAI embedding. by wewebber-merlin in https://github.com/hwchase17/langchain/pull/7070
* Fixed Office365 tool __init__.py files, tests, and get_tools() function by sdelgadoc in https://github.com/hwchase17/langchain/pull/7046
* docs: update `youtube` videos and tutorials by leo-gan in https://github.com/hwchase17/langchain/pull/6515
* Create arize_llm_observability.ipynb by hakantekgul in https://github.com/hwchase17/langchain/pull/7000
* Replace JIRA Arbitrary Code Execution vulnerability with finer grain API wrapper by JamalRahman in https://github.com/hwchase17/langchain/pull/6992
* Handle kwargs in FAISS.load_local() by mssalvatore in https://github.com/hwchase17/langchain/pull/6987
* Implement delete interface of vector store on AnalyticDB by wangxuqi in https://github.com/hwchase17/langchain/pull/7170
* Harrison/dataforseo by hwchase17 in https://github.com/hwchase17/langchain/pull/7214
* optimize pgvector `add_texts` by falmanna in https://github.com/hwchase17/langchain/pull/7185
* fix arize nb by hwchase17 in https://github.com/hwchase17/langchain/pull/7227
* Enable InMemoryDocstore to be constructed without providing a dict by mssalvatore in https://github.com/hwchase17/langchain/pull/6976
* docs: update docs strings for base unstructured loaders by MthwRobinson in https://github.com/hwchase17/langchain/pull/7222
* Update milvus and zilliz docstring by filip-halt in https://github.com/hwchase17/langchain/pull/7216
* Adding Marqo to vectorstore ecosystem by tomhamer in https://github.com/hwchase17/langchain/pull/7068
* Document loader for Cube Semantic Layer by MikeNitsenko in https://github.com/hwchase17/langchain/pull/6882
* remove arize nb by hwchase17 in https://github.com/hwchase17/langchain/pull/7238
* Harrison/scene xplain by hwchase17 in https://github.com/hwchase17/langchain/pull/7228
* Send evaluator logs to new session by hinthornw in https://github.com/hwchase17/langchain/pull/7206
* Add tags support for langchaintracer by hinthornw in https://github.com/hwchase17/langchain/pull/7207
* Add 'eval' tag by hinthornw in https://github.com/hwchase17/langchain/pull/7209
* Skip evaluation of unfinished runs by hinthornw in https://github.com/hwchase17/langchain/pull/7235
* Fix web_base.py by zomchak-code in https://github.com/hwchase17/langchain/pull/6519
* Update Hugging Face Hub notebook by HashemAlsaket in https://github.com/hwchase17/langchain/pull/7236
* Add concurrency to GitbookLoader by Yevgnen in https://github.com/hwchase17/langchain/pull/7069
* Harrison/parameter by hwchase17 in https://github.com/hwchase17/langchain/pull/7081
* Harrison/update anthropic by hwchase17 in https://github.com/hwchase17/langchain/pull/7237
* Add missing token_max in reduce.py acombine_docs by ShantanuNair in https://github.com/hwchase17/langchain/pull/7241
* bump ver to 225 by hwchase17 in https://github.com/hwchase17/langchain/pull/7244

New Contributors
* raoufchebri made their first contribution in https://github.com/hwchase17/langchain/pull/6893
* prakul made their first contribution in https://github.com/hwchase17/langchain/pull/7174
* langabi made their first contribution in https://github.com/hwchase17/langchain/pull/7202
* felixocker made their first contribution in https://github.com/hwchase17/langchain/pull/7165
* serhatgktp made their first contribution in https://github.com/hwchase17/langchain/pull/7159
* conboy made their first contribution in https://github.com/hwchase17/langchain/pull/7134
* why8023 made their first contribution in https://github.com/hwchase17/langchain/pull/7169
* keenborder786 made their first contribution in https://github.com/hwchase17/langchain/pull/7161
* hseung578 made their first contribution in https://github.com/hwchase17/langchain/pull/7133
* joshreini1 made their first contribution in https://github.com/hwchase17/langchain/pull/7096
* wewebber-merlin made their first contribution in https://github.com/hwchase17/langchain/pull/7070
* JamalRahman made their first contribution in https://github.com/hwchase17/langchain/pull/6992
* falmanna made their first contribution in https://github.com/hwchase17/langchain/pull/7185
* tomhamer made their first contribution in https://github.com/hwchase17/langchain/pull/7068
* MikeNitsenko made their first contribution in https://github.com/hwchase17/langchain/pull/6882
* zomchak-code made their first contribution in https://github.com/hwchase17/langchain/pull/6519
* Yevgnen made their first contribution in https://github.com/hwchase17/langchain/pull/7069
* ShantanuNair made their first contribution in https://github.com/hwchase17/langchain/pull/7241

**Full Changelog**: https://github.com/hwchase17/langchain/compare/v0.0.224...v0.0.225

Resources

• https://pypi.org/project/langchain
• https://pyup.io/changelogs/langchain/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34540
• https://github.com/hwchase17/langchain/issues/4833
• https://github.com/langchain-ai/langchain/pull/6992
• https://github.com/langchain-ai/langchain/releases/tag/v0.0.225