CVE-2024-27306

Advisory

Nucliadb version 3.1.0 upgrades aiohttp from version 3.9.3 to 3.9.4 in response to CVE-2024-27306.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* Hnsw algorithm by javitonino in https://github.com/nuclia/nucliadb/pull/2066
* Update h2 by javitonino in https://github.com/nuclia/nucliadb/pull/2069
* Max tokens for LLM by lferran in https://github.com/nuclia/nucliadb/pull/2065
* Do not deserialize empty nodes into RAM hnsw by javitonino in https://github.com/nuclia/nucliadb/pull/2070
* Query shard replicas as primary-secondary by lferran in https://github.com/nuclia/nucliadb/pull/2071
* Add global migration to purge orphan kbslugs keys from maindb by jotare in https://github.com/nuclia/nucliadb/pull/1963
* Support matryoshka embeddings by jotare in https://github.com/nuclia/nucliadb/pull/2063
* Adding AI tables storage by bloodbare in https://github.com/nuclia/nucliadb/pull/2018
* int order retuns only needed results by hermeGarcia in https://github.com/nuclia/nucliadb/pull/2076
* Back pressure: add more logging by lferran in https://github.com/nuclia/nucliadb/pull/2077
* Bump aiohttp and idna to fix vulnerabilities by lferran in https://github.com/nuclia/nucliadb/pull/2078
* Term query set by javitonino in https://github.com/nuclia/nucliadb/pull/2073
* Reuse field information when indexing paragraphs by javitonino in https://github.com/nuclia/nucliadb/pull/2081
* Bump rustls from 0.21.10 to 0.21.11 by dependabot in https://github.com/nuclia/nucliadb/pull/2082
* Fix pagination bug on catalog by lferran in https://github.com/nuclia/nucliadb/pull/2084
* Add origin source-id label alias by lferran in https://github.com/nuclia/nucliadb/pull/2085
* Support keep_markdown in models by javitonino in https://github.com/nuclia/nucliadb/pull/2087
* Feature-flag cleanup by lferran in https://github.com/nuclia/nucliadb/pull/2079
* Validate field ids against regex with fastapi / pydantic by lferran in https://github.com/nuclia/nucliadb/pull/2090
* Migrate to paragraphs v3 by javitonino in https://github.com/nuclia/nucliadb/pull/2089
* Completely remove vectorsets public api by lferran in https://github.com/nuclia/nucliadb/pull/2092
* Do not fail if apt-get update fails in CI by javitonino in https://github.com/nuclia/nucliadb/pull/2093
* Set to pending on field upload for existing resource by lferran in https://github.com/nuclia/nucliadb/pull/2095
* No vector metadata when opening by hermeGarcia in https://github.com/nuclia/nucliadb/pull/2091
* old version names by hermeGarcia in https://github.com/nuclia/nucliadb/pull/2096
* use rename by hermeGarcia in https://github.com/nuclia/nucliadb/pull/2097
* Cleanup ingest gRPC and id/slugs by jotare in https://github.com/nuclia/nucliadb/pull/2080
* Open index readers only need path, not config by jotare in https://github.com/nuclia/nucliadb/pull/2099
* Cleanup optionals from metadata file by jotare in https://github.com/nuclia/nucliadb/pull/2100
* Revert "Bigger k during layer>0 search" by javitonino in https://github.com/nuclia/nucliadb/pull/2101
* Fix identation on rollover by lferran in https://github.com/nuclia/nucliadb/pull/2104
* Ship pingcap cert by javitonino in https://github.com/nuclia/nucliadb/pull/2105
* Added limits to pagination by lferran in https://github.com/nuclia/nucliadb/pull/2108
* Fix fedora e2e by lferran in https://github.com/nuclia/nucliadb/pull/2109
* Be able to index a resource by storage referece by lferran in https://github.com/nuclia/nucliadb/pull/2094
* Set resource from storage tweaks by lferran in https://github.com/nuclia/nucliadb/pull/2111
* Faster HNSW insertion by javitonino in https://github.com/nuclia/nucliadb/pull/2102
* alias not rename by hermeGarcia in https://github.com/nuclia/nucliadb/pull/2115
* Add shard indexes metadata file by jotare in https://github.com/nuclia/nucliadb/pull/2103
* Deprecated unused OpStatus fields and don't compute counters anymore by jotare in https://github.com/nuclia/nucliadb/pull/2114
* Create indexes passsing its config by value by jotare in https://github.com/nuclia/nucliadb/pull/2116
* Less locking in ShardWriter by jotare in https://github.com/nuclia/nucliadb/pull/2117
* Store indexes file by write and rename by jotare in https://github.com/nuclia/nucliadb/pull/2120
* box readers + swap update by hermeGarcia in https://github.com/nuclia/nucliadb/pull/2122
* Concurrency by branch by javitonino in https://github.com/nuclia/nucliadb/pull/2126
* Remove previous ask resource feature by lferran in https://github.com/nuclia/nucliadb/pull/2124
* Stricter grpcio dependency requirements to ease installs by lferran in https://github.com/nuclia/nucliadb/pull/2123
* Add generated files on links by bloodbare in https://github.com/nuclia/nucliadb/pull/2125
* Fix S3 storage delete_object param name by jotare in https://github.com/nuclia/nucliadb/pull/2112
* Get semantic threshold from query endpoint by lferran in https://github.com/nuclia/nucliadb/pull/2127
* Limit the amount of vectorsets allowed by jotare in https://github.com/nuclia/nucliadb/pull/2128
* Update rust deps by javitonino in https://github.com/nuclia/nucliadb/pull/2130
* Onprem migrations on startup by lferran in https://github.com/nuclia/nucliadb/pull/2132
* Do not wait for nodes on onprem deploy by lferran in https://github.com/nuclia/nucliadb/pull/2134
* Set normalize_vectors as optional by jotare in https://github.com/nuclia/nucliadb/pull/2133
* CI wip by javitonino in https://github.com/nuclia/nucliadb/pull/2121
* Fix wrong usage of fastapi endpoint docs by jotare in https://github.com/nuclia/nucliadb/pull/2113
* Properly close asyncio loop by lferran in https://github.com/nuclia/nucliadb/pull/2135
* Add test for rollover resilient to modifications and deletions by lferran in https://github.com/nuclia/nucliadb/pull/2106
* prefer_markdown option in chat by vangheem in https://github.com/nuclia/nucliadb/pull/2098


**Full Changelog**: https://github.com/nuclia/nucliadb/compare/v3.0.3...v3.1.0

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27306
• https://github.com/nuclia/nucliadb/pull/2078/commits/087889df99428eb7ca71f2ea039a9ca5a274b1d5