Merge pull request #82 from Cray-HPE/casmcms-9062

CASMCMS-9062: Resolve CVEs
Cray-HPE · Jul 25, 2024 · ca83539 · ca83539
2 parents 63eea63 + 155dc02
commit ca83539
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Dependencies
+- Resolve CVES:
+  - Bump `certifi` from 2019.11.28 to 2023.7.22
+  - Require `setuptools` >= 70.0
+  - Use CSM re-built Alpine container as base of Docker image
+
 ## [2.13.1] - 2024-04-12
 ### Changed
 - CASMTRIAGE-6885 - fix etc/resolv.conf resolution when it is a broken symlink.

diff --git a/Dockerfile b/Dockerfile
@@ -24,7 +24,7 @@
 # Cray Image Management Service image build environment utilities Dockerfile
 #
 
-FROM artifactory.algol60.net/docker.io/alpine:3.15 as base
+FROM artifactory.algol60.net/docker.io/library/alpine:3.15 as base
 
 # Add utilities that are required for this command
 WORKDIR /

diff --git a/constraints.txt b/constraints.txt
@@ -1,7 +1,7 @@
 boto3==1.12.49
 botocore==1.15.49
 cachetools==3.0.0
-certifi==2019.11.28
+certifi==2023.7.22
 chardet==3.0.4
 docutils==0.14
 google-auth==1.6.3
@@ -21,6 +21,7 @@ requests==2.23.0
 requests-oauthlib==1.0.0
 rsa==4.7.2
 s3transfer==0.3.7
+setuptools>=70.0
 six==1.15.0
 urllib3==1.25.11
 websocket-client==0.54.0