[Task]: Remediate CVE-2024-28397

[markustoivonen]

What needs to happen?

It seems that one of the python libraries Beam uses, js2py, has a vulnerability:

CVE-2024-28397

Exposure seems fairly limited (not sure if its even realistic to be exploited when using Beam).

Issue Priority

Priority: 3 (nice-to-have improvement)

Issue Components

• Component: Python SDK
• Component: Java SDK
• Component: Go SDK
• Component: Typescript SDK
• Component: IO connector
• Component: Beam YAML
• Component: Beam examples
• Component: Beam playground
• Component: Beam katas
• Component: Website
• Component: Spark Runner
• Component: Flink Runner
• Component: Samza Runner
• Component: Twister2 Runner
• Component: Hazelcast Jet Runner
• Component: Google Cloud Dataflow Runner

[jhammarstedt]

Hi, what's the status on this one? Getting high severity warning in my workflows when bumping beam to 2.57

[liferoad]

@Polber PTAL.

[derrickaw]

Briefly looked into it and it seems v0.74 is still the latest version. Probably should either wait until another version comes out that fixes this vulnerability or find another python library to use that doesn't have a vulnerability.

[github-actions]

This issue has been marked as stale due to 150 days of inactivity. It will be closed in 30 days if no further activity occurs. If you think that’s incorrect or this issue still needs to be addressed, please simply write any comment. If closed, you can reopen the issue at any time. Thank you for your contributions.