You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(container): patch pyasn1 and joserfc CVEs - #13247
API (api/pyproject.toml, api/uv.lock): pyasn1 0.6.4 → 0.6.5
MCP server (mcp_server/pyproject.toml, mcp_server/uv.lock): joserfc 1.6.8 → 1.7.5
MCP server image (mcp_server/Dockerfile): runtime base python:3.13.16-alpine3.23 → python:3.13.18-alpine3.23, digest-pinned like before. The SDK and API images got the same CVE fix in fix(container): bump Python base image to 3.12.16 #13215.
Only the SDK image failed the gate on #13246, because the API and MCP image scans only run when those components change. Both pin the same vulnerable versions, so they are patched here too.
Compatibility: pyasn1-modules 0.4.2 accepts pyasn1>=0.6.1,<0.7.0, moto accepts joserfc>=0.9.0, and joserfc 1.7.5 still supports Python 3.10. The lockfile diffs change only these two packages.
Steps to review
Check that the lockfile diffs move only pyasn1 and joserfc.
sdk-container-build-and-scan, api-container-build-and-scan and mcp-container-build-and-scan pass with no HIGH findings.
Locally: uv run pytest tests/providers/aws/services/cognito tests/providers/gcp/gcp_provider_test.py tests/providers/huaweicloud (386 passed) and the MCP suite (251 passed). The MCP image builds locally, runs Python 3.13.18 and imports prowler_mcp_server.
Checklist
Community Checklist
This feature/issue is listed in the open issues or roadmap.prowler.com
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit
Bug Fixes
Updated security components to patched versions, addressing denial-of-service vulnerabilities in ASN.1 decoding and JWE decryption. These updates improve resilience when processing affected data. The updated versions are pyasn1 0.6.5 and joserfc 1.7.5.
Updated the MCP Server’s Python runtime to version 3.13.18, which includes a security fix.
No actionable comments were generated in the recent review.
Walkthrough
The API, MCP server, and root project update their pyasn1 and joserfc dependency constraints. The MCP Server image updates its Python base image. Changelog entries record the associated advisories.
Changes: Security updates
Layer / File(s)
Summary
Dependency constraints and advisory records api/pyproject.toml, pyproject.toml, mcp_server/pyproject.toml, api/changelog.d/*, mcp_server/changelog.d/*, prowler/changelog.d/*
Updates pyasn1 from 0.6.4 to 0.6.5 and joserfc from 1.6.8 to 1.7.5. Changelog entries describe the associated advisories.
MCP Server Python image update mcp_server/Dockerfile, mcp_server/changelog.d/mcp-python-3.13.18.security.md
Updates the runtime image from Python 3.13.16 to 3.13.18 and records the change as addressing CVE-2026-115557.
prowler-cloud/prowler#13215: Both PRs update Python container base images in relation to CVE-2026-115557. This PR updates the MCP image to Python 3.13.18; the related PR updates SDK and API images to Python 3.12.16.
Suggested reviewers:pedrooot, cesararroba
Merge Risk: Minimal · up to 2edb9
No actionable issue was identified in the supplied dependency and runtime-image updates. Merge readiness remains subject to normal build, test, and container security checks.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title clearly identifies the primary change: patching the pyasn1 and joserfc CVEs. It is concise and relevant to the changeset.
Description check
The description includes the required context, change summary, dependency updates, review steps, checklist, test results, compatibility notes, and license confirmation. It is sufficiently complete, al…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Description check
Explanation
The description includes the required context, change summary, dependency updates, review steps, checklist, test results, compatibility notes, and license confirmation. It is sufficiently complete, although it lists scan success as a review step rather than reporting completed scan results.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.
✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.56%. Comparing base (67aa941) to head (2edb941). ⚠️ Report is 1 commits behind head on master.
The reason will be displayed to describe this comment to others. Learn more.
🟢 Approval recommended
No active review issues are reported for the security dependency updates across the SDK, API, and MCP server.
No open issues 🎉
What changed in this PR
Updates vulnerable dependencies across Prowler’s SDK, API, and MCP server to address denial-of-service advisories behind the container scan failures observed on #13246.
Changes:
Bumps pyasn1 to 0.6.5 in the SDK and API, and joserfc to 1.7.5 in the SDK and MCP server.
Refreshes lockfiles, including SDK/API format revisions and dependency-marker adjustments.
Adds security changelog fragments for all three components.
File
Description
uv.lock
Locks patched SDK dependencies and refreshes lock metadata.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Context
The
sdk-container-build-and-scanTrivy gate is failing on every PR that builds the SDK image (seen on #13246) with 5 HIGH findings:This PR's own
mcp-container-build-and-scanthen flagged a CRITICAL in the MCP Server base image:Description
Bumps the pins to the fixed versions everywhere they appear:
pyproject.toml,uv.lock): pyasn1 0.6.4 → 0.6.5, joserfc 1.6.8 → 1.7.5api/pyproject.toml,api/uv.lock): pyasn1 0.6.4 → 0.6.5mcp_server/pyproject.toml,mcp_server/uv.lock): joserfc 1.6.8 → 1.7.5mcp_server/Dockerfile): runtime basepython:3.13.16-alpine3.23→python:3.13.18-alpine3.23, digest-pinned like before. The SDK and API images got the same CVE fix in fix(container): bump Python base image to 3.12.16 #13215.Only the SDK image failed the gate on #13246, because the API and MCP image scans only run when those components change. Both pin the same vulnerable versions, so they are patched here too.
Compatibility:
pyasn1-modules0.4.2 acceptspyasn1>=0.6.1,<0.7.0, moto acceptsjoserfc>=0.9.0, and joserfc 1.7.5 still supports Python 3.10. The lockfile diffs change only these two packages.Steps to review
sdk-container-build-and-scan,api-container-build-and-scanandmcp-container-build-and-scanpass with no HIGH findings.uv run pytest tests/providers/aws/services/cognito tests/providers/gcp/gcp_provider_test.py tests/providers/huaweicloud(386 passed) and the MCP suite (251 passed). The MCP image builds locally, runs Python 3.13.18 and importsprowler_mcp_server.Checklist
Community Checklist
SDK/CLI
API
MCP Server
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit