kserve/0.14.1-r0: cve remediation

[octo-sts]

kserve/0.14.1-r0: fix CVE-2024-45341

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/kserve.advisories.yaml

Source code for this service: https://go/cve-remedy-automation-source

Logs for this execution: https://go/cve-remedy-automation-logs

Docs for this service: (not provided yet)

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

• Detected Error: [Build fails during Poetry dependency installation]

• Error Category: Dependency/Version

• Failure Point: Poetry dependency resolution during the storage-controller build step

• Root Cause Analysis:
The build is failing due to version conflicts and incompatible dependencies in the Python packages. The issue appears after removing multiple dependencies that are likely required by Ray or other core components.

• Suggested Fix:

1. Modify the poetry-build-storage-controller step to explicitly pin key dependencies:

poetry add "ray==2.24.0" \
          "aiohttp==3.10.11" \
          "setuptools==70.0.0" \
          "starlette==0.40.0" \
          "jinja2==3.1.5" \
          --no-interaction

2. Add explicit dependencies that were being removed:

poetry add "aiohappyeyeballs>=2.4.0" \
          "aiohttp-cors>=0.7.0" \
          "wrapt>=1.16.0" \
          "opencensus>=0.11.4" \
          "opencensus-context>=0.1.3" \
          --no-interaction

• Explanation:
The dependency resolution is removing required packages because of version conflicts. By explicitly pinning versions and adding back required dependencies, we ensure the build environment has all necessary components while maintaining security fixes.

• Additional Notes:

• Consider using poetry.lock file to ensure reproducible builds
• Monitor CVE updates for Ray and its dependencies
• May need to add more explicit dependencies if build still fails

• References:

• KServe Python Dependencies: https://github.com/kserve/kserve/blob/master/python/kserve/pyproject.toml
• Ray Security Advisories: https://github.com/ray-project/ray/security/advisories
• Poetry Dependency Resolution: https://python-poetry.org/docs/dependency-specification/

Would you like me to provide a complete updated version of the poetry-build-storage-controller step?