rbrooks/WeatherBot
Watch
1
0
Fork
You've already forked WeatherBot
 0
Code Issues 11 Pull requests 6 Projects Releases 16 Packages 1 Wiki Activity Actions

🔒 Automated security scan findings #195

New issue
Open
opened 2026-09-26 07:12:20 +00:00 by renovate-bot · 3 comments
renovate-bot commented 2026-09-26 07:12:20 +00:00
Contributor
Copy link

Automated security scan

Filed by the fleet security scanner (.forgejo/workflows/security-scan.yml). Re-runs update this issue.

📦 git.rhoving.com/rbrooks/weatherbot:2.0.1 (41 CVEs)

Production-pinned — weatherbot_image in inventory/group_vars/weatherbot/vars.yml.

CVE Severity Package Installed Fixed
CVE-2026-112393 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112398 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112403 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112900 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-96639 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-96760 CRITICAL Authlib 1.7.2 1.9.0
GHSA-6q48-6c7w-9gw2 CRITICAL certifi 2026.7.22 2026.10.18
CVE-2025-47273 HIGH setuptools 70.3.0 78.1.1
CVE-2026-109518 HIGH apt 3.0.3 3.0.4
CVE-2026-112390 HIGH pillow 12.3.0 13.0.0
CVE-2026-112392 HIGH pillow 12.3.0 13.0.0
CVE-2026-112397 HIGH pillow 12.3.0 13.0.0
CVE-2026-112399 HIGH pillow 12.3.0 13.0.0
CVE-2026-112400 HIGH pillow 12.3.0 13.0.0
CVE-2026-112402 HIGH pillow 12.3.0 13.0.0
CVE-2026-112404 HIGH pillow 12.3.0 13.0.0
CVE-2026-112405 HIGH pillow 12.3.0 13.0.0
CVE-2026-112406 HIGH pillow 12.3.0 13.0.0
CVE-2026-112892 HIGH pillow 12.3.0 13.0.0
CVE-2026-112893 HIGH pillow 12.3.0 13.0.0
CVE-2026-112894 HIGH pillow 12.3.0 13.0.0
CVE-2026-112895 HIGH pillow 12.3.0 13.0.0
CVE-2026-112896 HIGH pillow 12.3.0 13.0.0
CVE-2026-112897 HIGH pillow 12.3.0 13.0.0
CVE-2026-112902 HIGH pillow 12.3.0 13.0.0
CVE-2026-114613 HIGH msgpack 1.1.2 1.2.3
CVE-2026-114615 HIGH Authlib 1.7.2 1.9.0
CVE-2026-114616 HIGH Authlib 1.7.2 1.9.1
CVE-2026-116672 HIGH Authlib 1.7.2 1.9.1
CVE-2026-76844 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-85091 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-96637 HIGH pillow 12.3.0 13.0.0
CVE-2026-96640 HIGH pillow 12.3.0 13.0.0
CVE-2026-96642 HIGH pillow 12.3.0 13.0.0
CVE-2026-96643 HIGH pillow 12.3.0 13.0.0
CVE-2026-96644 HIGH pillow 12.3.0 13.0.0
CVE-2026-96778 HIGH pillow 12.3.0 13.0.0
CVE-2026-97687 HIGH urllib3 2.7.0 2.8.0
CVE-2026-97689 HIGH urllib3 2.7.0 2.8.0
GHSA-6v7p-g79w-8964 HIGH msgpack 1.1.2 1.2.1
GHSA-78g4-xqwv-q3g8 HIGH pillow 12.3.0 13.0.0
<!-- fleet-security-scan --> ## Automated security scan Filed by the fleet security scanner (`.forgejo/workflows/security-scan.yml`). Re-runs update this issue. ### 📦 `git.rhoving.com/rbrooks/weatherbot:2.0.1` (41 CVEs) **Production-pinned** — `weatherbot_image` in `inventory/group_vars/weatherbot/vars.yml`. | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-112393 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112398 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112403 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112900 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96639 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96760 | CRITICAL | `Authlib` | 1.7.2 | 1.9.0 | | GHSA-6q48-6c7w-9gw2 | CRITICAL | `certifi` | 2026.7.22 | 2026.10.18 | | CVE-2025-47273 | HIGH | `setuptools` | 70.3.0 | 78.1.1 | | CVE-2026-109518 | HIGH | `apt` | 3.0.3 | 3.0.4 | | CVE-2026-112390 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112392 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112397 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112399 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112400 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112402 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112404 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112405 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112406 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112892 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112893 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112894 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112895 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112896 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112897 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112902 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-114613 | HIGH | `msgpack` | 1.1.2 | 1.2.3 | | CVE-2026-114615 | HIGH | `Authlib` | 1.7.2 | 1.9.0 | | CVE-2026-114616 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-116672 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-76844 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-85091 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-96637 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96640 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96642 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96643 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96644 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96778 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-97687 | HIGH | `urllib3` | 2.7.0 | 2.8.0 | | CVE-2026-97689 | HIGH | `urllib3` | 2.7.0 | 2.8.0 | | GHSA-6v7p-g79w-8964 | HIGH | `msgpack` | 1.1.2 | 1.2.1 | | GHSA-78g4-xqwv-q3g8 | HIGH | `pillow` | 12.3.0 | 13.0.0 |
claude-bot commented 2026-10-13 14:45:09 +00:00
Collaborator
Copy link

Picked up 2026-10-13 — fix in #200

Triage of the 249 findings against weatherbot:1.8.1:

Group Findings Cause Fix in #200
linux-libc-dev (194), libpq-dev (17), libssl-dev (2) 213 gcc and -dev headers installed in the image that ships Two-stage Dockerfile; compiler confined to the build stage
PyJWT (1 critical + 5 high), starlette (2), urllib3 (2), cryptography (1) 11 Two stale pins, plus two transitive packages that were never pinned starlette 1.8.0, cryptography 50.0.2; pyjwt and urllib3 pinned
perl-base, libpcre2, libsqlite3, gzip, bsdutils with a fix published ~17 Base tag older than the Debian fixes apt-get upgrade in the runtime stage
libncursesw6, libacl1, libsystemd0, 4× bsdutils, 1× perl-base ~8 No fix upstream yet None available; will remain in the scan

Two things worth recording:

  • The critical PyJWT finding is not reachable through this app's own code. Nothing in app/ imports jwt; it is a dependency of twilio. OIDC token handling uses authlib.jose. That lowers the urgency, it does not remove the finding.
  • main already resolves to fixed PyJWT/urllib3 purely because they float. The scan is of 1.8.1 as built on 2026-08-01. Any image built from main today would differ from the scanned one in ways nobody chose, which is the real defect; hence the explicit pins.

pip-audit on the resolved set after #200: no known vulnerabilities. It becomes a blocking CI step in the same PR.

This issue will not clear when #200 merges. The scanner reads the production pin, so the table above only changes once a release containing the fix is tagged and weatherbot_image is bumped in iac-repo.

## Picked up 2026-10-13 — fix in #200 Triage of the 249 findings against `weatherbot:1.8.1`: | Group | Findings | Cause | Fix in #200 | |---|---:|---|---| | `linux-libc-dev` (194), `libpq-dev` (17), `libssl-dev` (2) | 213 | gcc and `-dev` headers installed in the image that ships | Two-stage Dockerfile; compiler confined to the build stage | | `PyJWT` (1 critical + 5 high), `starlette` (2), `urllib3` (2), `cryptography` (1) | 11 | Two stale pins, plus two transitive packages that were never pinned | starlette 1.8.0, cryptography 50.0.2; pyjwt and urllib3 pinned | | `perl-base`, `libpcre2`, `libsqlite3`, `gzip`, `bsdutils` with a fix published | ~17 | Base tag older than the Debian fixes | `apt-get upgrade` in the runtime stage | | `libncursesw6`, `libacl1`, `libsystemd0`, 4× `bsdutils`, 1× `perl-base` | ~8 | No fix upstream yet | None available; will remain in the scan | Two things worth recording: - **The critical PyJWT finding is not reachable through this app's own code.** Nothing in `app/` imports `jwt`; it is a dependency of `twilio`. OIDC token handling uses `authlib.jose`. That lowers the urgency, it does not remove the finding. - **`main` already resolves to fixed PyJWT/urllib3** purely because they float. The scan is of 1.8.1 as built on 2026-08-01. Any image built from `main` today would differ from the scanned one in ways nobody chose, which is the real defect; hence the explicit pins. `pip-audit` on the resolved set after #200: no known vulnerabilities. It becomes a blocking CI step in the same PR. **This issue will not clear when #200 merges.** The scanner reads the production pin, so the table above only changes once a release containing the fix is tagged and `weatherbot_image` is bumped in iac-repo.
claude-bot commented 2026-10-13 14:52:19 +00:00
Collaborator
Copy link

Fix merged to main via #200 (74d5dec) — not yet released or deployed

CI run 241 green in 6m12s. Confirmed from the job log rather than the status alone:

  • The two-stage image built (first build of the new Dockerfile anywhere), with starlette-1.8.0, cryptography-50.0.2, pyjwt-2.15.1, urllib3-2.8.0 installed.
  • import app.main plus the native dependencies (asyncpg, cryptography, matrix-nio, discord.py, Pillow with JPEG and zlib) ran inside the built image, and the gcc-absent assertion passed.
  • pip-audit --strict passed as a blocking step.
  • Bulk and Postgres test tiers passed.

Still open

  • The image has only been imported, not run. The entrypoint's privilege drop and uvicorn starting from the copied venv are first exercised when a tagged build is deployed to dev.
  • Production is still on the scanned 1.8.1. This issue's table changes only after a release containing 74d5dec is tagged and weatherbot_image is bumped in iac-repo.
  • Expect roughly 8 findings to remain after that (libncursesw6, libacl1, libsystemd0, part of bsdutils, one perl-base): no upstream fix exists.
  • #179 (Renovate, cryptography 50) is superseded and should close itself on Renovate's next run.

Leaving this open until the deployed image is rescanned.

## Fix merged to `main` via #200 (`74d5dec`) — not yet released or deployed CI run 241 green in 6m12s. Confirmed from the job log rather than the status alone: - The two-stage image **built** (first build of the new Dockerfile anywhere), with `starlette-1.8.0`, `cryptography-50.0.2`, `pyjwt-2.15.1`, `urllib3-2.8.0` installed. - `import app.main` plus the native dependencies (asyncpg, cryptography, matrix-nio, discord.py, Pillow with JPEG and zlib) ran **inside the built image**, and the `gcc`-absent assertion passed. - `pip-audit --strict` passed as a blocking step. - Bulk and Postgres test tiers passed. ## Still open - **The image has only been imported, not run.** The entrypoint's privilege drop and uvicorn starting from the copied venv are first exercised when a tagged build is deployed to dev. - **Production is still on the scanned 1.8.1.** This issue's table changes only after a release containing `74d5dec` is tagged and `weatherbot_image` is bumped in iac-repo. - Expect roughly 8 findings to remain after that (`libncursesw6`, `libacl1`, `libsystemd0`, part of `bsdutils`, one `perl-base`): no upstream fix exists. - #179 (Renovate, cryptography 50) is superseded and should close itself on Renovate's next run. Leaving this open until the deployed image is rescanned.
renovate-bot commented 2026-10-14 07:07:53 +00:00
Author
Contributor
Copy link

Latest scan found no HIGH/CRITICAL issues — closing.

<!-- fleet-security-scan --> Latest scan found no HIGH/CRITICAL issues — closing.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/python-minorpatch
renovate/test-deps-(automerge)
renovate/timezonefinder-9.x
renovate/python-3.x
renovate/pillow-13.x
chore/changelog-2.0.1
fix/spc-day-match
chore/changelog-2.0.0
chore/changelog-rc7
feat/location-radar-archive
fix/radar-frame-cadence
chore/changelog-rc6
fix/location-form-reset
fix/freshness-banner-and-explorer-day-target
chore/changelog-rc5
fix/spc-issue-time
fix/security-scan-195
renovate/bbernhard-signal-cli-rest-api-0.x
feat/event-export
feat/event-radar-loops
feat/explorer-event
feat/explorer-day
feat/explorer-calendar
feat/media-storage-abstraction
fix/allclear-image-url-space
fix/webex-permanent-failure
fix/incomplete-feed-guards
fix/false-all-clear-supersession
feat/radar-frames
feat/history-capture-ungate
renovate/cryptography-49.x
renovate/pillow-12.x
renovate/timezonefinder-8.x
v2.0.1
v2.0.0
v2.0.0-rc7
v2.0.0-rc6
v2.0.0-rc5
v2.0.0-rc4
v2.0.0-rc3
v2.0.0-rc2
v2.0.0-rc1
v1.8.1
v1.8.0
v1.7.0
v1.6.2
v1.6.1
v1.6.0
v1.5.0
v1.4.0
v1.3.0
v1.2.0
v1.1.0
v1.0.3
v1.0.2
v1.0.1
v1.0.0
Labels
Clear labels   
area:ai
AI summarization

  
area:ci-cd
Continuous integration / deployment

  
area:notifications
Notification delivery & formatting

  
area:observability
Freshness, diagnostics, metrics, admin ops

  
area:public-pages
Public alert / SPC / link pages

  
backlog
Post-2.0 / not yet scheduled

  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
security
Security hardening / vulnerability work

  
type:decision
Requires a product/design decision before/with implementation

  
type:feature
New functionality

  
type:infra
CI/CD, build, deployment infrastructure

  
type:maintenance
Tech debt, deprecations, cleanup

  
type:security
Security / abuse mitigation

  
v1.0.1
Target release: v1.0.1 (maintenance & deprecations)

  
v1.1.0
Target release: v1.1.0 (operations & observability)

  
v1.2.0
Target release: v1.2.0 (notification formatting hardening)

  
v1.3.0
Target release: v1.3.0 (AI summarization expansion)

  
v2.0.0
Target release: v2.0.0 (Historical Weather Event Explorer)

  
wontfix
This won't be fixed

No labels
area:ai
area:ci-cd
area:notifications
area:observability
area:public-pages
backlog
bug
duplicate
enhancement
help wanted
invalid
question
security
type:decision
type:feature
type:infra
type:maintenance
type:security
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v2.0.0
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/WeatherBot#195
No description provided.