CWE-362 - anyio Race Condition

chore: Fixes CWE-362 - anyio Race Condition. Affected versions of this package are vulnerable to Race Condition in _eventloop.get_asynclib() that cause crashes when multiple event loops of the same backend are running in separate threads and simultaneously attempting to use AnyIO for the first time. Signed-off-by: Spolti <[email protected]>
opendatahub-io · Jun 28, 2024 · c9e71a0 · c9e71a0
1 parent 77cb50e
commit c9e71a0
Show file tree

Hide file tree

Showing 16 changed files with 8,028 additions and 7,957 deletions.
diff --git a/python/aiffairness/poetry.lock b/python/aiffairness/poetry.lock
diff --git a/python/alibiexplainer/poetry.lock b/python/alibiexplainer/poetry.lock
diff --git a/python/artexplainer/poetry.lock b/python/artexplainer/poetry.lock
diff --git a/python/custom_model/poetry.lock b/python/custom_model/poetry.lock
diff --git a/python/custom_tokenizer/poetry.lock b/python/custom_tokenizer/poetry.lock
diff --git a/python/custom_transformer/poetry.lock b/python/custom_transformer/poetry.lock
diff --git a/python/huggingfaceserver/poetry.lock b/python/huggingfaceserver/poetry.lock
diff --git a/python/kserve/poetry.lock b/python/kserve/poetry.lock
diff --git a/python/kserve/pyproject.toml b/python/kserve/pyproject.toml
@@ -53,6 +53,9 @@ timing-asgi = "^0.3.0"
 tabulate = "^0.9.0"
 pandas = ">=1.3.5"
 pydantic = ">1.0,<3"
+pyyaml = "^6.0.0"
+# Fixes CWE-362, review overtime to make sure this librari was updated so it can be removed.
+anyio = "^4.4.0"
 
 # Storage dependencies. They can be opted into by apps.
 urllib3 = { version = "^1.26.8", optional = true }

diff --git a/python/lgbserver/poetry.lock b/python/lgbserver/poetry.lock
diff --git a/python/paddleserver/poetry.lock b/python/paddleserver/poetry.lock
diff --git a/python/pmmlserver/poetry.lock b/python/pmmlserver/poetry.lock
diff --git a/python/sklearnserver/poetry.lock b/python/sklearnserver/poetry.lock
diff --git a/python/test_resources/graph/error_404_isvc/poetry.lock b/python/test_resources/graph/error_404_isvc/poetry.lock
diff --git a/python/test_resources/graph/success_200_isvc/poetry.lock b/python/test_resources/graph/success_200_isvc/poetry.lock
diff --git a/python/xgbserver/poetry.lock b/python/xgbserver/poetry.lock