CWE-362 - anyio Race Condition

chore: Fixes CWE-362 - anyio Race Condition. Affected versions of this package are vulnerable to Race Condition in _eventloop.get_asynclib() that cause crashes when multiple event loops of the same backend are running in separate threads and simultaneously attempting to use AnyIO for the first time. Signed-off-by: Spolti <fspolti@redhat.com>
spolti · Jun 27, 2024 · 71104e1 · 71104e1
1 parent 03a45bb
commit 71104e1
Show file tree

Hide file tree

Showing 16 changed files with 10,733 additions and 10,635 deletions.
diff --git a/docs/samples/explanation/alibi/alibiexplainer/poetry.lock b/docs/samples/explanation/alibi/alibiexplainer/poetry.lock
diff --git a/python/aiffairness/poetry.lock b/python/aiffairness/poetry.lock
diff --git a/python/artexplainer/poetry.lock b/python/artexplainer/poetry.lock
diff --git a/python/custom_model/poetry.lock b/python/custom_model/poetry.lock
diff --git a/python/custom_tokenizer/poetry.lock b/python/custom_tokenizer/poetry.lock
diff --git a/python/custom_transformer/poetry.lock b/python/custom_transformer/poetry.lock
diff --git a/python/huggingfaceserver/poetry.lock b/python/huggingfaceserver/poetry.lock
diff --git a/python/kserve/poetry.lock b/python/kserve/poetry.lock
diff --git a/python/kserve/pyproject.toml b/python/kserve/pyproject.toml
@@ -53,6 +53,8 @@ tabulate = "^0.9.0"
 pandas = ">=1.3.5"
 pydantic = ">1.0,<3"
 pyyaml = "^6.0.0"
+# Fixes CWE-362, review overtime to make sure this librari was updated so it can be removed.
+anyio = "^4.4.0"
 
 # Storage dependencies. They can be opted into by apps.
 requests = { version = "^2.20.0", optional = true }

diff --git a/python/lgbserver/poetry.lock b/python/lgbserver/poetry.lock
diff --git a/python/paddleserver/poetry.lock b/python/paddleserver/poetry.lock
diff --git a/python/pmmlserver/poetry.lock b/python/pmmlserver/poetry.lock
diff --git a/python/sklearnserver/poetry.lock b/python/sklearnserver/poetry.lock
diff --git a/python/test_resources/graph/error_404_isvc/poetry.lock b/python/test_resources/graph/error_404_isvc/poetry.lock
diff --git a/python/test_resources/graph/success_200_isvc/poetry.lock b/python/test_resources/graph/success_200_isvc/poetry.lock
diff --git a/python/xgbserver/poetry.lock b/python/xgbserver/poetry.lock