From 913e306a4bcde5c1444d88e457ff7237ab8be196 Mon Sep 17 00:00:00 2001 From: "TEAM 4.0[bot]" Date: Mon, 16 Feb 2026 07:34:28 +0000 Subject: [PATCH 1/3] Update `requirements.txt` --- .github/utils/direct_requirements.txt | 6 +++--- requirements.txt | 11 ++++++----- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/utils/direct_requirements.txt b/.github/utils/direct_requirements.txt index 4a6a20e7..ab50c0df 100644 --- a/.github/utils/direct_requirements.txt +++ b/.github/utils/direct_requirements.txt @@ -1,7 +1,7 @@ -fastapi-slim>=0.128.5 +fastapi-slim>=0.129.0 hypercorn>=0.17.3 oteapi-core>=1.0.1 pydantic>=2.12.5 -pydantic-settings>=2.12.0 -redis>=7.1.0 +pydantic-settings>=2.13.0 +redis>=7.1.1 tenacity>=9.1.4 diff --git a/requirements.txt b/requirements.txt index 4d967d5d..aac9aefc 100644 --- a/requirements.txt +++ b/requirements.txt @@ -13,11 +13,12 @@ click==8.3.1 click-didyoumean==0.3.1 click-plugins==1.1.1.2 click-repl==0.3.0 -cryptography==46.0.4 +cryptography==46.0.5 diskcache==5.6.3 et_xmlfile==2.0.0 exceptiongroup==1.3.1 -fastapi-slim==0.128.5 +fastapi==0.129.0 +fastapi-slim==0.129.0 h11==0.16.0 h2==4.3.0 hpack==4.1.0 @@ -29,20 +30,20 @@ openpyxl==3.1.5 oteapi-core==1.0.1 packaging==26.0 paramiko==3.5.1 -pillow==12.1.0 +pillow==12.1.1 priority==2.0.0 prompt_toolkit==3.0.52 psycopg==3.3.2 psycopg-binary==3.3.2 pycparser==3.0 pydantic==2.12.5 -pydantic-settings==2.12.0 +pydantic-settings==2.13.0 pydantic_core==2.41.5 PyNaCl==1.6.2 pysftp==0.2.9 python-dateutil==2.9.0.post0 python-dotenv==1.2.1 -redis==7.1.0 +redis==7.1.1 requests==2.32.5 six==1.17.0 starlette==0.52.1 From 0556fd18313f0c46b51744e1910c902337cbef1a Mon Sep 17 00:00:00 2001 From: Casper Welzel Andersen Date: Mon, 16 Feb 2026 12:39:32 +0100 Subject: [PATCH 2/3] Ignore diskcache safety issue --- .github/workflows/ci_tests.yml | 6 ++++++ Dockerfile | 7 ++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci_tests.yml b/.github/workflows/ci_tests.yml index 32ced2bb..49d229df 100644 --- a/.github/workflows/ci_tests.yml +++ b/.github/workflows/ci_tests.yml @@ -35,6 +35,12 @@ jobs: uses: pypa/gh-action-pip-audit@v1.1.0 with: inputs: requirements.txt .dev/requirements_ci.txt .dev/requirements_dev.txt .dev/requirements_docker_dev.txt .dev/requirements_release.txt + # CVE-2025-69872: DiskCache 5.6.3 + # DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. + # An attacker with write access to the cache directory can achieve arbitrary code execution + # when a victim application reads from the cache. + ignore-vulns: | + CVE-2025-69872 - name: Fail if pre-commit failed run: | diff --git a/Dockerfile b/Dockerfile index 50c6eaa9..2873a11b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -55,7 +55,12 @@ RUN python -m venv /tmp/dev_venv \ # Run static security check, linters, and pytest with code coverage RUN --mount=type=cache,target=/root/.cache/pre-commit \ git init && git add . && /tmp/dev_venv/bin/pre-commit run -c .pre-commit-config_docker.yaml --all-files -RUN /tmp/dev_venv/bin/pip-audit -r /app/requirements.txt --desc on + +# CVE-2025-69872: DiskCache 5.6.3 +# DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. +# An attacker with write access to the cache directory can achieve arbitrary code execution +# when a victim application reads from the cache. +RUN /tmp/dev_venv/bin/pip-audit -r /app/requirements.txt --desc on --ignore-vuln CVE-2025-69872 # Install extra (non-dev tools) development requirements in main environment RUN pip install -q -U -r requirements_dev.txt From d55f135e1d5fefb17a3f807ad16ab6084f732a05 Mon Sep 17 00:00:00 2001 From: Casper Welzel Andersen Date: Mon, 16 Feb 2026 12:41:00 +0100 Subject: [PATCH 3/3] Added note about diskcache issue in README --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index 5a4e69e0..308f3d1f 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,11 @@ To use a version of the `oteapi` Docker image that runs only on the latest stable version of `oteapi-core`, use the version tag `1.20240228.345` or earlier. Example: `ghcr.io/emmc-asbl/oteapi:1.20240228.345`. +> **Warning**: There is currently a security vulnerability in the `oteapi` Docker image that is caused by the use of `diskcache` version 5.6.3. +> This vulnerability is tracked as [CVE-2025-69872](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69872). +> The vulnerability is mitigated by the fact that an attacker would need write access to the cache directory to achieve arbitrary code execution, and this is not the case for the default configuration of the `oteapi` Docker image. +> However, if you are using a custom configuration that allows write access to the cache directory, please be aware of this vulnerability and take appropriate measures to secure your system. + ## Run in Docker ### Development target