CVE-2024-30251

Advisory

Heart-library version 0.3.2 updates its `aiohttp` dependency from 3.9.3 to 3.9.5 to address vulnerabilities such as CVE-2024-30251.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

https://github.com/IBM/heart-library

https://pypi.org/project/heart-library/

Update Notes

- Deprecation of YOLOv5 due to known vulnerability (https://github.com/advisories/GHSA-jjg7-2v4v-x38h).
- Support for DeTR object detector estimator. Object detection notebooks updated to demonstrate DeTR in place of deprecated YOLOv5.
- Minor changes to remove SAST vulnerabilities.
- Transitive dependency updates in poetry.lock to remove vulnerabilities.

Known Issue

`setuptools>=70.0.0` causes a breaking issue within `adversarial-robustness-toolbox` when attempting to import `pkg_resources` within [art/estimators/speech_recognition/pytorch_deep_speech.py](https://github.com/Trusted-AI/adversarial-robustness-toolbox/blob/main/art/estimators/speech_recognition/pytorch_deep_speech.py#L26). This import pathway was deprecated with the major version release of `setuptools==70.0.0`.

**Workaround:**

Re-install `setuptools` using version `69.5.1` in your virtual environment.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-30251
• https://github.com/IBM/heart-library/commit/3f9047e735fe0afcc3b04e9001c5bb1facb3c1e9?diff=split&w=0#diff-f53a023eedfa3fbf2925ec7dc76eecdc954ea94b7e47065393dbad519613dc89L64