Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency mudler/localai to v2.25.0 #9520

Merged
merged 1 commit into from
Jan 11, 2025
Merged

chore(deps): update dependency mudler/localai to v2.25.0 #9520

merged 1 commit into from
Jan 11, 2025
+1 −1

Conversation

uniget-bot
Copy link

This PR contains the following updates:

Package Update Change
mudler/LocalAI minor 2.24.2 -> 2.25.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

mudler/LocalAI (mudler/LocalAI)

v2.25.0

Compare Source

What's Changed

Bug fixes 🐛
Exciting New Features 🎉
🧠 Models
📖 Documentation and examples
👒 Dependencies
Other Changes

New Contributors

Full Changelog: mudler/LocalAI@v2.24.0...v2.25.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

nicholasdille-bot
nicholasdille-bot approved these changes Jan 11, 2025
View reviewed changes
Copy link

@nicholasdille-bot nicholasdille-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approved because label type/renovate is present.

@github-actions GitHub Actions
Copy link

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/local-ai:2.25.0

📦 Image Reference ghcr.io/uniget-org/tools/local-ai:2.25.0
digestsha256:0ab7ca28ff22cd0787c6c1cf7e1b8804a7b0092f0988af5e7cf39881f62abcf3
vulnerabilitiescritical: 1 high: 0 medium: 3 low: 0
platformlinux/amd64
size461 MB
packages243
critical: 1 high: 0 medium: 0 low: 0 github.com/docker/docker 27.0.3+incompatible (golang)

pkg:golang/github.com/docker/docker@27.0.3+incompatible

critical 9.4: CVE--2024--41110 Partial String Comparison

Affected range>=27.0.0
<27.1.1
Fixed version27.1.1
CVSS Score9.4
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description

A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. This advisory outlines the issue, identifies the affected versions, and provides remediation steps for impacted users.

Impact

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

Vulnerability details

  • AuthZ bypass and privilege escalation: An attacker could exploit a bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectly.
  • Initial fix: The issue was fixed in Docker Engine v18.09.1 January 2019..
  • Regression: The fix was not included in Docker Engine v19.03 or newer versions. This was identified in April 2024 and patches were released for the affected versions on July 23, 2024. The issue was assigned CVE-2024-41110.

Patches

  • docker-ce v27.1.1 containes patches to fix the vulnerability.
  • Patches have also been merged into the master, 19.0, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches.

Remediation steps

  • If you are running an affected version, update to the most recent patched version.
  • Mitigation if unable to update immediately:
    • Avoid using AuthZ plugins.
    • Restrict access to the Docker API to trusted parties, following the principle of least privilege.

References

critical: 0 high: 0 medium: 1 low: 0 github.com/mudler/localai 2.25.0 (golang)

pkg:golang/github.com/mudler/localai@2.25.0

medium : CVE--2024--48057

Affected range>=0
Fixed versionNot Fixed
Description

LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI

critical: 0 high: 0 medium: 1 low: 0 github.com/libp2p/go-libp2p-kad-dht 0.28.1 (golang)

pkg:golang/github.com/libp2p/go-libp2p-kad-dht@0.28.1

medium : CVE--2023--26248

Affected range>=0
Fixed versionNot Fixed
Description

Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht

critical: 0 high: 0 medium: 1 low: 0 github.com/mholt/archiver/v3 3.5.1 (golang)

pkg:golang/github.com/mholt/archiver/v3@3.5.1

medium 6.1: CVE--2024--0406 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected range>=3.0.0
<=3.5.1
Fixed versionNot Fixed
CVSS Score6.1
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Description

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

@github-actions GitHub Actions
Copy link

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/12720140953.

@github-actions GitHub Actions
Copy link

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/12720140953.

@github-actions github-actions bot merged commit 6c05393 into main Jan 11, 2025
10 of 11 checks passed
@github-actions github-actions bot deleted the renovate/mudler-localai-2.x branch January 11, 2025 02:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nicholasdille-bot nicholasdille-bot nicholasdille-bot approved these changes

Assignees
No one assigned
Labels
bump/minor type/renovate
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@uniget-bot @nicholasdille-bot @renovate-bot