CVE-2024-34062

Advisory

Fl4health version 0.1.15 updates the tqdm library from version 4.66.2 to 4.66.4 following the discovery of a vulnerability identified as CVE-2024-34062, as detected by pip-audit.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* Ditto FLamby implementation scripts. by emersodb in https://github.com/VectorInstitute/FL4Health/pull/112
* Small fix for when sampling dataloaders produce an empty batch. by emersodb in https://github.com/VectorInstitute/FL4Health/pull/114
* Fixing two small typos by emersodb in https://github.com/VectorInstitute/FL4Health/pull/118
* Fixing an issue with Opacus modified models and optimizers. by emersodb in https://github.com/VectorInstitute/FL4Health/pull/119
* Upgrading pycyclops to ^0.2.5 and removing exceptions on pip-audit by lotif in https://github.com/VectorInstitute/FL4Health/pull/121
* Update torch, flwr and other requirements by jewelltaylor in https://github.com/VectorInstitute/FL4Health/pull/120
* Displaying all the smoke tests metrics errors at once by lotif in https://github.com/VectorInstitute/FL4Health/pull/122
* Updating the README to include Ditto by emersodb in https://github.com/VectorInstitute/FL4Health/pull/123
* AG News Experiments and Basic Client Refactor by yc7z in https://github.com/VectorInstitute/FL4Health/pull/124
* Adding an implementation for FedDG-GA by lotif in https://github.com/VectorInstitute/FL4Health/pull/117
* Add MR-MTL Method by sanaAyrml in https://github.com/VectorInstitute/FL4Health/pull/125
* Updating the start numpy client code. by emersodb in https://github.com/VectorInstitute/FL4Health/pull/126
* Update tqdm (pip-audit found a vulnerability) by amrit110 in https://github.com/VectorInstitute/FL4Health/pull/133
* Bump jinja2 from 3.1.3 to 3.1.4 by dependabot in https://github.com/VectorInstitute/FL4Health/pull/140
* Bump werkzeug from 3.0.1 to 3.0.3 by dependabot in https://github.com/VectorInstitute/FL4Health/pull/139
* Enable pre-commit ci and add default config by amrit110 in https://github.com/VectorInstitute/FL4Health/pull/132
* Skip flake8 on pre-commit bot by lotif in https://github.com/VectorInstitute/FL4Health/pull/141
* Implementing FedRep by emersodb in https://github.com/VectorInstitute/FL4Health/pull/127
* Adding the ability to specify a checkpointing for models **before** aggregation. by emersodb in https://github.com/VectorInstitute/FL4Health/pull/128
* Creating an Opacus specific Checkpointer by emersodb in https://github.com/VectorInstitute/FL4Health/pull/129
* Forcing better model consistency for Server-side models with Opacus by emersodb in https://github.com/VectorInstitute/FL4Health/pull/130
* Consolidate Weight Drift Losses by emersodb in https://github.com/VectorInstitute/FL4Health/pull/131
* Add dependabot config to update github actions by amrit110 in https://github.com/VectorInstitute/FL4Health/pull/142
* Bump actions/setup-python from 3 to 5 by dependabot in https://github.com/VectorInstitute/FL4Health/pull/143
* Bump actions/checkout from 3 to 4 by dependabot in https://github.com/VectorInstitute/FL4Health/pull/144
* Bump actions/cache from 2 to 4 by dependabot in https://github.com/VectorInstitute/FL4Health/pull/145
* Bump pypa/gh-action-pypi-publish from 1.4.2 to 1.8.14 by dependabot in https://github.com/VectorInstitute/FL4Health/pull/146

New Contributors
* dependabot made their first contribution in https://github.com/VectorInstitute/FL4Health/pull/140

**Full Changelog**: https://github.com/VectorInstitute/FL4Health/compare/v0.1.13...v0.1.15

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34062
• https://github.com/VectorInstitute/FL4Health/pull/133/commits/c7d4c5718c11cd9857a6cfcd9b168c28e7aa962f#diff-f53a023eedfa3fbf2925ec7dc76eecdc954ea94b7e47065393dbad519613dc89L5901