Skip to content

Commit 4c8bfba

Browse files
yeshsuryayeshsurya
authored
Week 21: vuln fixes for non-ACFT images (aoai/automl/general/vision) (#5060)
* Week 20: vuln fixes for non-ACFT images (aoai/automl/general/vision) Includes: aoai-data-upload-finetune, ai-ml-automl-dnn{,-text-gpu,-text-gpu-ptca,-vision-gpu}, acpt-pytorch-2.2-cuda12.1, acpt-pytorch-2.8-cuda12.6, automl-dnn-vision-gpu.
1 parent e8538bf commit 4c8bfba

8 files changed

Lines changed: 170 additions & 132 deletions

File tree

‎assets/training/aoai/proxy_components/environments/context/Dockerfile‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,5 @@
11
FROM mcr.microsoft.com/azureml/openmpi5.0-ubuntu24.04:{{latest-image-tag}}
22

3-
# Security: upgrade all OS packages so the image picks up the latest USN-patched
4-
# versions from Ubuntu noble-updates (e.g. USN-8222-1 openssh, USN-8226-1 kmod,
5-
# USN-8227-1 curl, USN-8229-1 sed, USN-8233-1 nghttp2). The base image is the
6-
# parent for these packages; we cannot bump it directly, so an in-image upgrade
7-
# is the standard remediation.
8-
RUN apt-get update && \
9-
DEBIAN_FRONTEND=noninteractive apt-get -y upgrade && \
10-
apt-get clean && rm -rf /var/lib/apt/lists/*
11-
123
COPY requirements.txt .
134

145
RUN pip install -r requirements.txt --no-cache-dir

‎assets/training/aoai/proxy_components/environments/context/requirements.txt‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@ azureml-telemetry==1.56.0
88
pydantic==2.7.0
99
azure-keyvault-secrets==4.8.0
1010
requests==2.33.0
11-
urllib3==2.6.3
12-
pillow==12.2.0
11+
urllib3==2.7.0
12+
# cryptography is pulled in transitively by azure-identity / msal /
13+
# azure-keyvault-secrets, none of which pin a fixed minimum. The base
14+
# image (openmpi5.0-ubuntu24.04) currently ships cryptography 44.0.3,
15+
# which is vulnerable to GHSA-r6ph-v2qm-q3c2 (CVE-2026-26007) and
16+
# GHSA-m959-cc7f-wv43 (CVE-2026-34073). Override to >=46.0.7 (latest
17+
# fixed line) until the base image upgrades.
1318
cryptography>=46.0.7

‎assets/training/automl/environments/ai-ml-automl-dnn-text-gpu-ptca/context/Dockerfile‎

Lines changed: 43 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,11 @@ FROM mcr.microsoft.com/aifx/acpt/stable-ubuntu2204-cu126-py310-torch280:{{latest
22

33
USER root:root
44

5-
# Update system package index and upgrade Python 3.10 packages to required versions.
6-
# openssh-client is reinstalled explicitly after `apt-get upgrade` to force pickup
7-
# of USN-8222-1 (>= 1:8.9p1-3ubuntu0.15). The stable-ubuntu2204-cu126-py310-torch280
8-
# base image (biweekly.202605.1) ALREADY ships 1:8.9p1-3ubuntu0.15 (verified with
9-
# `dpkg -l openssh-client`), but `apt-get upgrade` alone has been observed to leave
10-
# an older 1:8.9p1-3ubuntu0.14 in place when older base layers are cached during
11-
# rebuilds, so the explicit reinstall is kept as a defensive measure (same pattern
12-
# as assets/training/finetune_acft_multimodal/.../Dockerfile). openssh is shipped
13-
# by the Ubuntu base, so the only available remediation is the apt upgrade itself.
145
RUN apt-get update && \
156
apt-get upgrade -y && \
16-
apt-get install --reinstall -y openssh-client && \
177
apt-get clean && rm -rf /var/lib/apt/lists/* && \
188
apt-get autoremove -y
199

20-
# try updating pip for base and ptca env using conda
21-
RUN conda install pip -n base -y
22-
RUN conda install pip -n ptca -y
23-
2410
RUN pip install --no-cache-dir \
2511
'azureml-automl-dnn-nlp=={{latest-pypi-version}}' \
2612
'azureml-defaults=={{latest-pypi-version}}'
@@ -44,34 +30,48 @@ RUN pip install \
4430
# Root cause: azureml-automl-dnn-nlp==1.62.0 (latest) pins transformers==4.53.0; cannot upgrade parent
4531
RUN pip install --no-cache-dir --no-deps 'transformers[sentencepiece,torch]==5.5.4'
4632

47-
# Address vulnerabilities
48-
# Patch for Pillow vulnerability : Direct dep (used by bokeh, torchvision) from base image
49-
RUN pip install --upgrade 'pillow>=12.1.1'
50-
51-
# Fix security vulnerabilities (ptca env)
52-
# NOTE: azureml-mlflow~=1.62.0 pins cryptography<46.0.0; upgrading anyway for CVE fix
53-
# setuptools vendors jaraco.context internally; >=82.0.1 bundles the patched version (GHSA-58pv-8j8x-9vj2)
54-
# Override onnx to fix GHSA-cmw6-hcpp-c6jp, GHSA-538c-55jv-c5g9, GHSA-q56x-g2fj-4rj6, GHSA-p433-9wv8-28xj, GHSA-3r9x-f23j-gc73, GHSA-hqmj-h5c6-369m
55-
# Root cause: azureml-automl-runtime==1.62.0 (latest) pins onnx<=1.17.0; cannot upgrade parent
56-
RUN pip install --upgrade 'wheel>=0.46.2' 'cryptography>=46.0.5' 'setuptools>=82.0.1' 'distributed>=2026.1.0' 'filelock>=3.20.3' 'bokeh>=3.8.2' 'protobuf>=6.33.5' 'onnx>=1.21.0'
57-
58-
59-
# Vulnerability patches for ptca environment
60-
# pytest override: GHSA-6w46-j5rx-g56g — from ACPT base image ptca env; base image not yet patched
61-
RUN /opt/conda/envs/ptca/bin/pip install --upgrade 'pytest>=9.0.3'
33+
# Vulnerability patches for ptca environment (python 3.10 at /opt/conda/envs/ptca)
34+
# pip 26.0.1 -> >=26.1.1 (GHSA-jp4c-xjxw-mgf9, CVE-2026-6357): pip is base infra;
35+
# no parent package brings it, so a direct upgrade is the only fix. The stale
36+
# conda-meta JSON for pip-26.0.1 is removed so scanners do not re-flag it.
37+
# setuptools 81.0.0 -> >=82.0.1 (GHSA-58pv-8j8x-9vj2 in vendored jaraco.context):
38+
# setuptools is a build dependency with no parent that pins it.
39+
# pytest >=9.0.3 (GHSA-6w46-j5rx-g56g): ACPT base ptca env not yet patched.
40+
# Override onnx to fix GHSA-cmw6-hcpp-c6jp, GHSA-538c-55jv-c5g9, GHSA-q56x-g2fj-4rj6,
41+
# GHSA-p433-9wv8-28xj, GHSA-3r9x-f23j-gc73, GHSA-hqmj-h5c6-369m.
42+
# Root cause: azureml-automl-runtime==1.62.0 (latest) pins onnx<=1.17.0; cannot upgrade parent.
43+
# bokeh 2.4.3 -> >=3.8.2 (GHSA-793v-589g-574v, CVE-2026-21883) and distributed
44+
# 2023.2.0 -> >=2026.1.0 (GHSA-c336-7962-wfj2, CVE-2026-23528) are pulled in by
45+
# azureml-automl-runtime==1.62.0 which pins bokeh==2.4.3 and distributed==2023.2.0;
46+
# no newer azureml-automl-runtime release exists, so direct override is required.
47+
RUN /opt/conda/envs/ptca/bin/pip install --upgrade \
48+
'pip>=26.1.1' \
49+
'setuptools>=82.0.1' \
50+
'pytest>=9.0.3' \
51+
'onnx>=1.21.0' \
52+
'bokeh>=3.8.2' \
53+
'distributed>=2026.1.0' && \
54+
rm -f /opt/conda/envs/ptca/conda-meta/pip-26.0.1-*.json
6255

63-
# Fix security vulnerabilities (conda base env, python 3.13 at /opt/conda)
64-
# Verified against base image biweekly.202605.1 (2026-05-08):
65-
# cryptography 46.0.7, wheel 0.46.3, PyJWT 2.12.1, aiohttp 3.13.5 — already patched
66-
# in base image, so the previous overrides for these were removed (cleanup).
67-
# setuptools 82.0.0 — base ships 82.0.0 but jaraco.context fix (GHSA-58pv-8j8x-9vj2)
68-
# requires >=82.0.1, so override is retained.
69-
# python-dotenv 1.2.1 — base ships 1.2.1 (GHSA-mf9w-mj56-hr94, set_key()/unset_key()
70-
# follow symlinks on cross-device .env writes -> arbitrary file overwrite). Required
71-
# version is >=1.2.2. Brought in transitively by anaconda-auth==0.14.2 (Requires-Dist:
72-
# python-dotenv with no version pin) and pydantic-settings==2.12.0 (python-dotenv>=0.21.0,
73-
# via anaconda-cli-base -> anaconda-auth). Latest releases on PyPI as of 2026-05-08
74-
# (anaconda-auth==0.14.4, pydantic-settings==2.14.0) still use the same loose floors,
75-
# so a parent upgrade cannot force >=1.2.2 — direct override required.
76-
RUN /opt/conda/bin/pip install --upgrade 'setuptools>=82.0.1' 'python-dotenv>=1.2.2'
56+
# Vulnerability patches for conda base env (python 3.13 at /opt/conda)
57+
# pip 26.0.1 -> >=26.1.1 (GHSA-jp4c-xjxw-mgf9, CVE-2026-6357): pip is base infra;
58+
# no parent package brings it, so a direct upgrade is the only fix.
59+
# urllib3 2.6.3 -> >=2.7.0 (GHSA-qccp-gfcp-xxvc / CVE-2026-44431, GHSA-mf9v-mfxr-j63j
60+
# / CVE-2026-44432): pulled in transitively by `requests` and many conda CLI deps
61+
# (anaconda-cloud-auth, conda, pip itself). `requests` has no upper bound on urllib3
62+
# (Requires-Dist: urllib3<3,>=1.21.1), and none of the conda parents pin urllib3
63+
# tightly, so no parent upgrade can force >=2.7.0 -- direct override required.
64+
# setuptools 82.0.0 -> >=82.0.1 (GHSA-58pv-8j8x-9vj2 in vendored jaraco.context):
65+
# no parent package pins setuptools.
66+
# python-dotenv 1.2.1 -> >=1.2.2 (GHSA-mf9w-mj56-hr94): brought in transitively by
67+
# anaconda-auth==0.14.2 (Requires-Dist: python-dotenv with no version pin) and
68+
# pydantic-settings==2.12.0 (python-dotenv>=0.21.0, via anaconda-cli-base ->
69+
# anaconda-auth). Latest releases on PyPI as of 2026-05-19 (anaconda-auth==0.14.4,
70+
# pydantic-settings==2.14.0) still use the same loose floors, so a parent upgrade
71+
# cannot force >=1.2.2 -- direct override required.
72+
RUN /opt/conda/bin/pip install --upgrade \
73+
'pip>=26.1.1' \
74+
'urllib3>=2.7.0' \
75+
'setuptools>=82.0.1' \
76+
'python-dotenv>=1.2.2'
7777

‎assets/training/automl/environments/ai-ml-automl-dnn-text-gpu/context/Dockerfile‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -115,25 +115,34 @@ RUN pip install --no-cache-dir --no-deps 'transformers[sentencepiece,torch]==5.5
115115
# only remediation. Kept as its own RUN to avoid the pip self-upgrade race.
116116
RUN pip install --no-cache-dir --upgrade 'pip>=26.1'
117117

118-
# Upgrade starlette, urllib3, bokeh, PyNaCl & filelock
119-
# NOTE: azureml-mlflow~=1.62.0 pins cryptography<46.0.0; upgrading anyway for CVE fix
118+
# Upgrade bokeh, cryptography, onnx in the AZUREML conda env (py3.10).
119+
# NOTE: azureml-mlflow==1.62.0.post2 (latest as of 2026-05-19) pins
120+
# cryptography<47.0.0; we use >=46.0.5 (compatible) to fix prior CVEs.
120121
# Override onnx to fix GHSA-cmw6-hcpp-c6jp, GHSA-538c-55jv-c5g9, GHSA-q56x-g2fj-4rj6, GHSA-p433-9wv8-28xj, GHSA-3r9x-f23j-gc73, GHSA-hqmj-h5c6-369m
121122
# Root cause: azureml-automl-runtime==1.62.0 (latest) pins onnx<=1.17.0; cannot upgrade parent
122123
RUN pip install --upgrade 'distributed>=2026.1.0' 'cryptography>=46.0.5' 'setuptools>=82.0.1' 'wheel>=0.46.2' 'bokeh>=3.8.2' 'onnx>=1.21.0'
123124

124-
# CLEANUP 2026-05-12: PTCA env package overrides removed because the ACPT base
125-
# image biweekly.202605.1 already ships:
126-
# filelock 3.25.2 (>= 3.20.3), pillow 12.2.0 (>= 12.1.1),
127-
# protobuf 7.34.1 (>= 6.33.5), wheel 0.46.3 (>= 0.46.2), pytest 9.0.3 (>= 9.0.3)
128-
# (verified by `pip show` in /opt/conda/envs/ptca on the base image). The previous
129-
# `cryptography>=46.0.5` override was also dropped — cryptography is not installed
130-
# in the PTCA env at all, so the override only added an unused package. If the
131-
# base image regresses any of these, restore the relevant overrides.
132-
# Fix vendored jaraco.context (GHSA-58pv-8j8x-9vj2) and wheel (GHSA-8rrh-rw8j-w5fx) in ptca/base setuptools
125+
# Fix vendored jaraco.context (GHSA-58pv-8j8x-9vj2) and wheel (GHSA-8rrh-rw8j-w5fx) in ptca/base setuptools.
133126
# setuptools vendors jaraco.context internally; --force-reinstall --no-deps ensures vendored copies are replaced.
134-
# Base image ships setuptools 82.0.0; we need 82.0.1 for the vendored fix, so override is retained.
127+
# Base image biweekly.202605.2 ships: base=82.0.0, ptca=81.0.0 (verified via probe build).
128+
# Both are below 82.0.1 (which carries the vendored fix), so both overrides are required.
135129
RUN /opt/conda/envs/ptca/bin/pip install --no-cache-dir --force-reinstall --no-deps 'setuptools==82.0.1'
136130

131+
# Security: upgrade urllib3 2.6.3 -> >=2.7.0 in the BASE conda env only
132+
# (/opt/conda, py3.13) to fix GHSA-qccp-gfcp-xxvc (CVE-2026-44431, MEDIUM) and
133+
# GHSA-mf9v-mfxr-j63j (CVE-2026-44432, HIGH) — both affect urllib3's streaming
134+
# response handling.
135+
# Probe build (2026-05-19) against base image biweekly.202605.2 confirmed:
136+
# /opt/conda (py3.13) -> urllib3 2.6.3 (vulnerable)
137+
# /opt/conda/envs/ptca (3.10) -> urllib3 2.7.0 (already fixed by base image)
138+
# So no PTCA override is needed; only base env requires upgrade.
139+
# Parent-upgrade analysis (2026-05-19): urllib3 in the base env is required by
140+
# `requests` only, which pins urllib3 with a loose floor (>=1.21.1,<3). No
141+
# package on PyPI as of today pins urllib3>=2.7.0 (urllib3 2.7.0 was published
142+
# 2026-05-13, same day the CVEs were disclosed), so a parent upgrade cannot
143+
# force the fixed version — direct override is the only remediation.
144+
RUN /opt/conda/bin/pip install --no-cache-dir --upgrade 'urllib3>=2.7.0'
145+
137146
# Security: python-dotenv 1.2.1 -> >=1.2.2 fixes GHSA-mf9w-mj56-hr94 (set_key()/
138147
# unset_key() follow symlinks on cross-device .env writes -> arbitrary file
139148
# overwrite). Lives in /opt/conda/lib/python3.13/site-packages of the BASE conda

‎assets/training/automl/environments/ai-ml-automl-dnn-vision-gpu/context/Dockerfile‎

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -99,12 +99,16 @@ RUN pip install --no-cache-dir \
9999
# GHSA-3r9x-f23j-gc73, GHSA-hqmj-h5c6-369m. Parent azureml-automl-runtime (1.62.0) cannot
100100
# be upgraded as latest still constrains onnx<=1.17.0.
101101
RUN pip install --no-cache-dir --upgrade \
102-
'cryptography>=46.0.5' \
102+
'cryptography>=46.0.7' \
103103
'distributed>=2026.1.0' \
104-
'mlflow-skinny>=2.16.0' \
104+
'mlflow-skinny>=2.16.0' \
105105
'bokeh>=3.8.2' \
106106
'pillow==12.2.0' \
107-
'onnx>=1.21.0'
107+
'onnx>=1.21.0' \
108+
'requests>=2.33.0' \
109+
'idna>=3.15' \
110+
'pyOpenSSL>=26.0.0' \
111+
'wheel>=0.46.2'
108112

109113

110114

@@ -115,9 +119,14 @@ RUN pip install --no-cache-dir --upgrade \
115119
# wheel to be imported during the self-update check. ptca env ships pip 26.0.1
116120
# from the ACPT base image; pip is its own parent (no upstream package can pull
117121
# in a fixed pip via dependency resolution), so explicit override is required.
118-
RUN /opt/conda/envs/ptca/bin/pip install --upgrade \
119-
'pillow==12.2.0' 'filelock>=3.20.3' 'cryptography>=46.0.5' 'protobuf>=6.33.5' 'wheel>=0.46.2' \
120-
'pytest>=9.0.3' 'pip>=26.1'
122+
# urllib3>=2.7.0 (GHSA-qccp-gfcp-xxvc, GHSA-mf9v-mfxr-j63j): urllib3 2.6.3 ships in the
123+
# ptca env (py3.10) via the ACPT base image as a transitive dep of requests/botocore.
124+
# urllib3 is its own root for security purposes — requests pins urllib3>=1.21.1,<3 and
125+
# botocore pins urllib3>=1.25.4,<2.5 (py<3.10) or <3 (py>=3.10), so no parent release
126+
# forces urllib3>=2.7.0. Explicit override is the only fix path.
127+
RUN /opt/conda/envs/ptca/bin/pip install --no-cache-dir --upgrade \
128+
'pillow==12.2.0' 'filelock>=3.20.3' 'cryptography>=46.0.7' 'protobuf>=6.33.5' 'wheel>=0.46.2' \
129+
'pytest>=9.0.3' 'pip>=26.1' 'urllib3>=2.7.0' 'requests>=2.33.0' 'idna>=3.15' 'pyOpenSSL>=26.0.0'
121130
# setuptools resolver picks wrong version due to dep conflicts; force install to fix jaraco.context vuln (GHSA-58pv-8j8x-9vj2)
122131
# setuptools vendors jaraco.context internally; --force-reinstall --no-deps ensures vendored copies are replaced
123132
RUN /opt/conda/envs/ptca/bin/pip install --no-cache-dir --force-reinstall --no-deps 'setuptools==82.0.1'
@@ -134,13 +143,22 @@ RUN /opt/conda/envs/ptca/bin/pip install --no-cache-dir --force-reinstall --no-d
134143
# wheel to be imported during the self-update check. Base conda env ships pip 26.0.1
135144
# from the ACPT base image; pip is its own parent (no upstream package can pull in
136145
# a fixed pip via dependency resolution), so explicit override is required.
146+
# urllib3>=2.7.0 (GHSA-qccp-gfcp-xxvc, GHSA-mf9v-mfxr-j63j): urllib3 2.6.3 is shipped
147+
# in the base conda env (py3.13) by the ACPT base image. urllib3 is a root security
148+
# package — its parents (requests pins urllib3>=1.21.1,<3; botocore pins
149+
# urllib3>=1.25.4,<3) do not bound it tightly enough to force 2.7.0, so no parent
150+
# upgrade can pull in the fix. Explicit override required.
137151
RUN conda run -n base pip install --no-cache-dir --upgrade \
138-
'cryptography>=46.0.5' \
152+
'cryptography>=46.0.7' \
139153
'wheel>=0.46.2' \
140154
'PyJWT>=2.12.0' \
141155
'aiohttp>=3.13.4' \
142156
'python-dotenv>=1.2.2' \
143-
'pip>=26.1'
157+
'pip>=26.1' \
158+
'urllib3>=2.7.0' \
159+
'requests>=2.33.0' \
160+
'idna>=3.15' \
161+
'pyOpenSSL>=26.0.0'
144162
# PyJWT 2.10.1 (CVE-2026-32597) is installed in the base conda env (python3.13) from ACPT base image; manually upgrading since base image hasn't been patched yet
145163
# Fix vendored jaraco.context (GHSA-58pv-8j8x-9vj2) and wheel (GHSA-8rrh-rw8j-w5fx) in base setuptools
146164
# setuptools vendors jaraco.context internally; --force-reinstall --no-deps ensures vendored copies are replaced

‎assets/training/automl/environments/ai-ml-automl-dnn/context/Dockerfile‎

Lines changed: 40 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,30 @@ ENV PATH=$AZUREML_CONDA_ENVIRONMENT_PATH/bin:$PATH
77
COPY --from=mcr.microsoft.com/azureml/mlflow-ubuntu20.04-py38-cpu-inference:20250506.v1 /var/mlflow_resources/ /var/mlflow_resources/
88

99
ENV MLFLOW_MODEL_FOLDER="mlflow-model"
10-
# ENV AML_APP_ROOT="/var/mlflow_resources"
11-
# ENV AZUREML_ENTRY_SCRIPT="mlflow_score_script.py"
1210

1311
ENV ENABLE_METADATA=true
1412

15-
# Security: upgrade all OS packages to fix USN vulnerabilities
16-
# Using --fix-missing to avoid failures when Ubuntu mirrors are mid-sync (systemd 404s)
13+
# Security: upgrade all OS packages to pick up the latest Ubuntu security errata
14+
# (covers USN-8222 openssh, USN-8226 kmod, USN-8227 curl, USN-8229 sed,
15+
# USN-8233 nghttp2, USN-8249 dpkg, etc.). --fix-missing tolerates mirror sync gaps.
1716
RUN apt-get update && \
1817
DEBIAN_FRONTEND=noninteractive apt-get -y upgrade --fix-missing && \
1918
apt-get clean && rm -rf /var/lib/apt/lists/*
2019

20+
# Security: upgrade pip in the base miniconda (/opt/miniconda) to fix
21+
# GHSA-jp4c-xjxw-mgf9 (pip < 26.1 self-update behaviour). The base image ships
22+
# pip 26.0.1 in /opt/miniconda; pip is its own parent so the only remediation
23+
# is an explicit upgrade. Done before the conda env is created.
24+
RUN /opt/miniconda/bin/pip install --no-cache-dir --upgrade 'pip>=26.1'
25+
26+
# Security: upgrade urllib3 in the base miniconda (/opt/miniconda) to >=2.7.0 for
27+
# GHSA-mf9v-mfxr-j63j and GHSA-qccp-gfcp-xxvc. Base miniconda ships urllib3 2.6.3.
28+
# urllib3 is a transitive dep of `requests` (which is pulled by conda/anaconda
29+
# client tooling); the latest `requests` (2.32.5) only requires urllib3<3, so
30+
# upgrading the parent `requests` cannot raise the urllib3 floor — direct
31+
# override is the only remediation for the /opt/miniconda site-packages copy.
32+
RUN /opt/miniconda/bin/pip install --no-cache-dir --upgrade 'urllib3>=2.7.0'
33+
2134
# begin conda create
2235
# Create conda environment (minimal — packages installed via pip to avoid solver OOM)
2336
RUN conda create -p $AZUREML_CONDA_ENVIRONMENT_PATH \
@@ -46,12 +59,15 @@ RUN conda run -p $AZUREML_CONDA_ENVIRONMENT_PATH pip install --no-cache-dir \
4659
'torch==2.8.0' \
4760
'scipy==1.10.1' \
4861
'psutil>5.0.0,<6.0.0' \
49-
'pip>=26.0'
62+
'pip>=26.1'
5063
# end conda create
5164

5265
# begin pip install
5366
# Install pip dependencies
54-
# GitPython>=3.1.41 is required for https://github.com/advisories/GHSA-2mqj-m65w-jghx and is not available in conda
67+
# GitPython>=3.1.50 overrides the transitive copy pulled in by mlflow-skinny ->
68+
# databricks-sdk -> gitpython (also pulled by azureml-* telemetry helpers).
69+
# Required for GHSA-7545-fcxq-7j24, GHSA-mv93-w799-cj2w, GHSA-v87r-6q3f-2j67;
70+
# parent packages still allow the older versions, so this direct floor is needed.
5571
RUN pip install \
5672
# begin pypi dependencies
5773
azureml-core=={{latest-pypi-version}} \
@@ -73,7 +89,7 @@ RUN pip install \
7389
'xgboost==1.5.2' \
7490
'mltable>=1.0.0' \
7591
'pytorch-transformers==1.0.0' \
76-
'GitPython>=3.1.41' \
92+
'GitPython>=3.1.50' \
7793
'spacy==3.7.4' \
7894
'pillow>=12.1.1' \
7995
'https://aka.ms/automl-resources/packages/en_core_web_sm-3.7.1.tar.gz'
@@ -106,9 +122,25 @@ RUN pip install \
106122
# still carries that upper bound, so a parent-package upgrade cannot
107123
# resolve the CVEs. Override required.
108124
# Chain (L1): azureml-automl-runtime -> onnx
125+
#
126+
# urllib3>=2.7.0 GHSA-mf9v-mfxr-j63j, GHSA-qccp-gfcp-xxvc
127+
# Chain (L1): requests -> urllib3 (pulled by ~every azureml-* pkg,
128+
# mlflow-skinny, mltable, azure-* SDKs). Latest `requests` 2.32.5
129+
# still declares `urllib3<3`, never `>=2.7`, so upgrading any
130+
# intermediate parent cannot raise the floor. Direct override required.
131+
#
132+
# ujson>=5.12.1 GHSA-c38f-wx89-p2xg (decode buffer overflow)
133+
# Chain (L1): azureml-defaults -> azureml-inference-server-http ->
134+
# gunicorn / flask / werkzeug helpers that pull ujson
135+
# Chain (L1): mlflow-skinny -> databricks-sdk -> ujson (optional)
136+
# ujson 5.12.1 is the only release with the patch and no parent
137+
# declares a tight pin on ujson, so the floor can only be raised
138+
# via a direct override here.
109139
RUN pip install --upgrade 'distributed>=2026.1.0' 'protobuf>=5.29.6' 'cryptography>=46.0.5' \
110140
'bokeh>=3.8.2' \
111-
'onnx>=1.21.0' # onnx: override azureml-automl-runtime pin for 6 GHSA CVEs
141+
'onnx>=1.21.0' \
142+
'urllib3>=2.7.0' \
143+
'ujson>=5.12.1'
112144
RUN rm -rf /opt/miniconda/pkgs/
113145

114146
ENV LD_LIBRARY_PATH=$AZUREML_CONDA_ENVIRONMENT_PATH/lib:$LD_LIBRARY_PATH

0 commit comments

Comments
 (0)