Update dependency streamlit to v1.11.1 [SECURITY] #603
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==1.2.0->==1.11.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2022-35918
Impact
Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information.
An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file.
Patches
On July 27th at 2:20PM PST we rolled out a patch in release 1.11.1. This patch ensures that any file operations are restricted only to the custom component directory and cannot traverse outside of that. We strongly recommend users upgrade to v1.11.1 as soon as possible. We have notified the Streamlit community and popular hosting providers about this issue so they can patch quickly. As a precautionary measure, we are also upgrading all users on Streamlit Cloud wherever possible. We continue to check other occurrences of this vulnerability and monitor potential exploits wherever we can.
Finally, as a general security practice, we recommend users review custom components for any malicious code before using them in their apps. Following security best practices such as running web servers with low privileges, firewalls, etc. for hosting your apps, helps in mitigating the severity of such exploits.
Workarounds
None.
References
For more information
If you have any questions or comments about this advisory:
Release Notes
streamlit/streamlit (streamlit)
v1.11.1Compare Source
v1.11.0Compare Source
v1.10.0Compare Source
v1.9.2Compare Source
v1.9.1Compare Source
v1.9.0Compare Source
v1.8.1Compare Source
v1.8.0Compare Source
v1.7.0Compare Source
v1.6.0Compare Source
server.enableWebsocketCompressionconfiguration option to re-enable it if you find the increased network traffic more impactful.
v1.5.1Compare Source
v1.5.0Compare Source
Release date: Jan 27, 2022
Notable Changes
disabledparameter that removes interactivity (completing all of our widgets) (#4314).Other Changes
on_changehandler only when necessary (#4270).v1.4.0Compare Source
Highlights
st.camera_inputfor uploading images straight from your camera.Notable Changes
disabledparameter that removes interactivity.st.experimental_memoandst.experimental_singletonprogrammatically by using theclear()method on a cached function.server.maxMessageSize.Other Changes
strorrepronthreading.current_thread()does not cause a RecursionError (#4172).v1.3.1Compare Source
v1.3.0Compare Source
Release date: Dec 16, 2021
Notable Changes
st.metric.st.spinnerelement has visual animated spinner.st.captionsupports HTML in text withunsafe_allow_htmlparameter.Other Changes
st.session_stateto be used to set number_input values with no warning (#4047).st.selectbox,st.select_slider,st.radio,st.number_input, andst.multiselect.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.