CVE-2021-23343

Advisory

Mlrun 1.1.0 updates the NPM package 'path-parse' in its base image to include a security fix.
https://github.com/mlrun/mlrun/pull/1997

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Main features & enhancements
* **API**: Support multi instance API, tankilevitch
* **API**: Remove auto project creation when project doesn't exist, tankilevitch
* **API**: Set username and refresh credentials in `mlrun.set_environment()`, yaronha
* **API**: Add Security context enrichment modes, AlonMaor14
* **Run**: Created the MLRun function decorator: `handler`, guy1992l
* **Artifacts**: Refactor SDK class to have `metadata`, `spec`, and `status`, theSaarco
* **Artifacts**: Improve work with paths + add artifacts import/export, yaronha
* **Runtimes**: Fix `build_config()` to preserve commands order, Hedingber
* **Runtimes**: Add java options spark job parameters, gtopper
* **Runtimes**: Fix monitoring handling of non-existing runs, tankilevitch
* **Runtimes**: Add s3 auto-mount option, theSaarco
* **Runtimes**: Add Security context support, AlonMaor14
* **Runtimes**: Bump the default spark operator version to `spark-3`, theSaarco
* **Runtimes**: Add patch option for `with_requests` & `with_limits`, tankilevitch
* **Runtimes**: Adding a modifier and auto-mount option to configure multiple env variables, theSaarco
* **Datastore**: Add `KafkaTarget` and `KafkaOutputStream`, gtopper
* **Datastore**: Support `wasb`/`wasbs` schema, speretz-ig
* **Datastore**: Improve BigQuery iterator performance, gtopper
* **Datastore**: CSVTarget timestamp format compatibility between Spark and Storey, gtopper
* **Datastore**: Adding option to force non-anonymous authentication when using S3, theSaarco
* **Builder**: Bump kaniko image version to 1.8.1, tankilevitch
* **Builder**: Support pushing images to ECR, AlonMaor14
* **Projects**: Fix/support archives with project run/build/deploy methods, yaronha
* **Projects**: Auto save in new_project(), yaronha
* **Projects**: Add timeout attribute to run method, tankilevitch
* **Projects**: Add `ensure_project` to CLI commands, tankilevitch
* **Projects**: Change default `new_project` to create instead of store, AlonMaor14
* **Projects**: Add RemoteRunner for supporting pipeline scheduling, yonishelach
* **Feature-store**: Support storey over redis, assaf758
* **Feature Store**: Add enrichments and validation to functions created through ingest endpoint, tankilevitch
* **Feature Store**: Fix iso conversion on parquet source, benbd86
* **Feature Store**: Fix drop of partitioning columns, gtopper
* **Spark**: Allow mounting v3io on driver but not executors, gtopper
* **Spark**: Fix statistics produced by spark engine, gtopper
* **Spark**: Add DNS-1035 validation, tankilevitch
* **Platforms**: Add s3 credentials mounter (modifier), yaronha
* **Model Monitoring**: : Create model monitoring feature set per model endpoint, EyalDanieliIgu
* **Runtimes**: Add ParallelRun router for running multiple steps in parallel threads/processes for serving, yaronha
* **Frameworks**: LightGBM module and booster MLRun interfaces for the `train` function, guy1992l
* **SDK**: Add retry mechanism for when encoutering transient connection errors, quaark
* **Functions**: Support git branches with Slashes as a git source, quaark
* **Images**: Fix security vulnerabilities, Hedingber
* **Requirements**: Raise PyArrow upper limit to 6.x, gtopper
* **Requirements**: Add vulnerability check to CI and fix vulnerabilities, Hedingber
* **Requirements**: Bump storey to 1.1.9, assaf758
* **UI**: [Release notes](https://github.com/mlrun/ui/releases/tag/v1.1.0)


More info can be found in the RCs release notes:

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23343