Update dependency streamlit to v1.37.0 [SECURITY] #639
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.
This PR contains the following updates:
==1.2.0->==1.37.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2022-35918
Impact
Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information.
An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file.
Patches
On July 27th at 2:20PM PST we rolled out a patch in release 1.11.1. This patch ensures that any file operations are restricted only to the custom component directory and cannot traverse outside of that. We strongly recommend users upgrade to v1.11.1 as soon as possible. We have notified the Streamlit community and popular hosting providers about this issue so they can patch quickly. As a precautionary measure, we are also upgrading all users on Streamlit Cloud wherever possible. We continue to check other occurrences of this vulnerability and monitor potential exploits wherever we can.
Finally, as a general security practice, we recommend users review custom components for any malicious code before using them in their apps. Following security best practices such as running web servers with low privileges, firewalls, etc. for hosting your apps, helps in mitigating the severity of such exploits.
Workarounds
None.
References
For more information
If you have any questions or comments about this advisory:
GHSA-8qw9-gf7w-42x5
Impact
The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific conditions.
Patches
We released an update in version 1.30.0 to further tighten security measures. Users are strongly advised to update to version 1.30.0 immediately for optimal security.
Workarounds
No additional workarounds are necessary once the update to version 1.30.0 is applied.
For more information
If you have any questions or comments about this advisory:
CVE-2024-42474
1. Impacted Products
Streamilt Open Source versions before 1.37.0.
2. Introduction
Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.
3. Path Traversal Vulnerability
3.1 Description
On May 12, 2024, Streamlit was informed via our bug bounty program about a path traversal vulnerability in the open source library. We fixed and merged a patch remediating the vulnerability on Jul 25, 2024. The issue was determined to be in the moderate severity range with a maximum CVSSv3 base score of 5.9
3.2 Scenarios and attack vector(s)
Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit.
3.3 Resolution
The vulnerability has been fixed in all Streamlit versions released since Jul 25, 2024. We recommend all users upgrade to Version 1.37.0.
4. Contact
Please contact security@snowflake.com if you have any questions regarding this advisory. If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Release Notes
streamlit/streamlit (streamlit)
v1.37.0Compare Source
What's Changed
New Features 🎉
st.bar_chartby @mayagbarnes in #8945graphviz.sources.Sourceobject forst.graphviz_chartby @sfc-gh-kbregula in #8993st.area_chartby @mayagbarnes in #8992Bug Fixes 🐛
st.switch_pageclears non-embed query params by @mayagbarnes in #9059Other Changes
deprecation.showPyplotGlobalUseconfig option by @LukasMasuch in #9018st.navigationdocstring by @mahotd in #9027New Contributors
Full Changelog: streamlit/streamlit@1.36.0...1.37.0
v1.36.0Compare Source
What's Changed
Breaking Changes 🛠
experimental_allow_widgetscaching parameter by @LukasMasuch in #8817New Features 🎉
st.columnsby @LukasMasuch in #8568iconparameter to st.expander by @snehankekre in #8716st.bar_chartby @mayagbarnes in #8877Bug Fixes 🐛
Other Changes
use_container_widthdocstring when default isTrueby @LukasMasuch in #8809New Contributors
Full Changelog: streamlit/streamlit@1.35.0...1.36.0
v1.35.0Compare Source
What's Changed
New Features 🎉
st.plotly_chartby @willhuang1997 in #8191st.logoby @mayagbarnes in #8554st.altair_chart&st.vega_lite_chartby @willhuang1997 in #8302Bug Fixes 🐛
Other Changes
st.tableby @LukasMasuch in #8621.updateand.from_dictby @Asaurus1 in #8614New Contributors
Full Changelog: streamlit/streamlit@1.34.0...1.35.0
v1.34.0Compare Source
What's Changed
New Features 🎉
st.dataframeandst.data_editorby @LukasMasuch in #7987<cached_func>.clear()by @OscarSaharoy in #8297st.audioandst.videomedia by @snehankekre in #8481Bug Fixes 🐛
st.statusby @LukasMasuch in #8369st.multiselectusage with empty sets or tuples by @LukasMasuch in #8471st.write_streamby @LukasMasuch in #8560Other Changes
New Contributors
Full Changelog: streamlit/streamlit@1.33.0...1.34.0
v1.33.0Compare Source
What's Changed
Breaking Changes 🛠
New Features 🎉
AreaChartColumnto column config by @LukasMasuch in #8237start_timeandend_time. by @kajarenc in #8348st.htmlby @mayagbarnes in #8366Bug Fixes 🐛
rerunand triggered widgets are used together in AppTest by @AnOctopus in #8264st.popovercontainer by @LukasMasuch in #8266Other Changes
New Contributors
Full Changelog: streamlit/streamlit@1.32.2...1.33.0
v1.32.2Compare Source
Full Changelog: streamlit/streamlit@1.32.1...1.32.2
v1.32.1Compare Source
Full Changelog: streamlit/streamlit@1.32.0...1.32.1
v1.32.0Compare Source
What's Changed
New Features 🎉
st.radiooptions by @LukasMasuch in #8028st.write_streamby @LukasMasuch in #8036st.writeby @LukasMasuch in #8039st.popoverlayout container by @LukasMasuch in #7908from_functionargs by @AnOctopus in #8183st.videoby @kajarenc in #8057Bug Fixes 🐛
st.query_paramsto string by @LukasMasuch in #8030time_inputmenu colors in dark mode by @LukasMasuch in #8056st.imageon windows. by @LukasMasuch in #8092st.page_link&st.switch_pagehandling / prefixed paths by @mayagbarnes in #8085st.switch_pageandst.page_linkby @kajarenc in #8103st.page_linkURL preview shows file path by @mayagbarnes in #8086Other Changes
deprecation.showPyplotGlobalUseconfig option by @LukasMasuch in #81333000is used by @LukasMasuch in #8152New Contributors
Full Changelog: streamlit/streamlit@1.31.1...1.32.0
v1.31.1Compare Source
Full Changelog: streamlit/streamlit@1.31.0...1.31.1
v1.31.0Compare Source
What's Changed
New Features 🎉
st.chat_inputby @LukasMasuch in #7896st.page_linkby @mayagbarnes in #7965st.write_streamcommand to handle generators or OpenAI output by @LukasMasuch in #7906Bug Fixes 🐛
noneorpollwatcher type by @LukasMasuch in #8024Other Changes
New Contributors
Full Changelog: streamlit/streamlit@1.30.0...1.31.0
v1.30.0Compare Source
What's Changed
New Features 🎉
heightparameter by @LukasMasuch in #7697LinkColumnby @LukasMasuch in #7784st.switch_pageby @mayagbarnes in #7853Bug Fixes 🐛
st.togglebackground color by @sfc-gh-jgarcia in #7788Other Changes
New Contributors
Full Changelog: streamlit/streamlit@1.29.0...1.30.0
v1.29.0Compare Source
What's Changed
Breaking Changes 🛠
New Features 🎉
st.dataframe,st.data_editorandst.table. by @LukasMasuch in #7689Bug Fixes 🐛
NoReturnannotation for stop and rerun by @kongzii in #7422st.graphviz_chartby @snehankekre in #7398st.containerby @AnOctopus in #7644st.rerunby @AnOctopus in #7643Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.