[develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to >=3.0.3 to address CVE-2024-34069 #6932

hehe7318 · 2025-08-06T21:48:07Z

Description of changes

Upgrade connexion to ~=2.15.0rc3.
Upgrade Werkzeug to ~=3.0.3 to address CVE-2024-34069.
Upgrade serverless_wsgi.py to the latest version.
Changes to encoder.py, flask_app.py and etc. to adapt the version bump.

Tests

Changes to tests to adapt the version bump.
Unit tests all passed.

References

Link to impacted open issues.
Link to related PRs in other packages (i.e. cookbook, node).
Link to documentation useful to understand the changes.

Checklist

Make sure you are pointing to the right branch.
If you're creating a patch for a branch other than develop add the branch name as prefix in the PR title (e.g. [release-3.6]).
Check all commits' messages are clear, describing what and why vs how.
Make sure to have added unit tests or integration tests to cover the new/modified code.
Check if documentation is impacted by this change.

Please review the guidelines for contributing and Pull Request Instructions.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

…0 to address CVE. Upgrade serverless_wsgi.py to the latest version. Changes to encoder, flask_app and etc. to adapt the version bump.

gmarciani · 2025-08-19T13:31:56Z

cli/src/pcluster/api/awslambda/serverless_wsgi.py

@@ -108,7 +108,7 @@
        "1",
    ]

-    if headers.get("Host", "").endswith(".amazonaws.com") and not strip_stage_path:
+    if "amazonaws.com" in headers.get("Host", "") and not strip_stage_path:


Why changing this check?

serverless_wsgi.py is a file we simply copy paste from https://github.com/logandk/serverless-wsgi/blob/master/serverless_wsgi.py.

gmarciani · 2025-08-19T13:31:56Z

cli/src/pcluster/api/awslambda/serverless_wsgi.py

@@ -108,7 +108,7 @@
        "1",
    ]

-    if headers.get("Host", "").endswith(".amazonaws.com") and not strip_stage_path:
+    if "amazonaws.com" in headers.get("Host", "") and not strip_stage_path:


Why changing this check?

gmarciani · 2025-08-19T13:36:48Z

CHANGELOG.md

@@ -31,6 +31,8 @@ CHANGELOG
 - Upgrade DCGM to version 4.2.3 (from 3.3.6) for all OSs except AL2.
 - Upgrade Python to 3.12.11 (from 3.12.8) for all OSs except AL2.
 - Upgrade Intel MPI Library to 2021.16.0 (from 2021.13.1).
+- Upgrade Connexion to ~=2.15.0rc3 (from ~=2.13.0).
+- Upgrade Werkzeug to >=3.0.3 (from ~=2.0) in response to this [security risk](https://nvd.nist.gov/vuln/detail/cve-2024-34069).


I'd say "...to address CVE-2024-34069."

Previously there is one like:

Upgrade Python from 3.7.10 to 3.7.13 in response to this security risk.

But I am fine with both approach.

gmarciani · 2025-08-19T13:37:08Z

cli/setup.py

    "jmespath~=0.10",
    "jsii==1.85.0",
+    "werkzeug>=3.0.3",
+    "flask~=3.0",
+    "packaging~=25.0",


Why we need to add packaging?

packaging is in requirement.txt. I didn't add it. It was there but not in setup.py, so I added it here.

gmarciani · 2025-08-19T13:38:35Z

cli/src/pcluster/api/encoder.py


 from pcluster.api.models.base_model_ import Model
 from pcluster.utils import to_iso_timestr


-class JSONEncoder(FlaskJSONEncoder):
+class JSONEncoderForCli(json.JSONEncoder):


Why ForCli? This encoder is used also by the API. Why not keeping the original class name?

gmarciani · 2025-08-19T13:39:25Z

cli/src/pcluster/api/awslambda/serverless_wsgi.py

        "REQUEST_METHOD": event.get("httpMethod", {}),
        "SCRIPT_NAME": script_name,
        "SERVER_NAME": headers.get("Host", "lambda"),
-        "SERVER_PORT": headers.get("X-Forwarded-Port", "80"),
+        "SERVER_PORT": headers.get("X-Forwarded-Port", "443"),


Here and below, why do we need to change the port and protocol?

serverless_wsgi.py is a file we simply copy paste from https://github.com/logandk/serverless-wsgi/blob/master/serverless_wsgi.py. Don't know why.

gmarciani · 2025-08-19T13:41:02Z

cli/src/pcluster/cli/entrypoint.py

@@ -217,15 +217,15 @@ def _run_operation(model, args, extra_args):
        except Exception as e:
            # format exception messages in the same manner as the api
            message = pcluster.api.errors.exception_message(e)
-            error_encoded = encoder.JSONEncoder().encode(message)
+            error_encoded = encoder.JSONEncoderForCli().encode(message)


Why do we need to use the new Json encoder in entrypoint.py, but not in app.py?

It's not the new one, it's the old one actually. In connexion new v2 version(not 2.15.0rc3, but before it), the previous FlaskJSONEncoder was removed.
I renamed the two classes. Now it should be better.

gmarciani · 2025-08-19T13:42:02Z

cli/setup.py

    "jmespath~=0.10",
    "jsii==1.85.0",
+    "werkzeug>=3.0.3",


I suggest to accept only patch version upgrade (~=)

That means we can not get the 3.1.3 latest version. But you are right, we can not say werkzeug 4.0 in the future will not break our prod. I will do it in your way.

Finally do ~=3.1

Upgrade connexion to 2.15.0rc3(Temporary). Upgrade Werkzeug to ~=3.0.…

2960785

…0 to address CVE. Upgrade serverless_wsgi.py to the latest version. Changes to encoder, flask_app and etc. to adapt the version bump.

hehe7318 requested review from a team as code owners August 6, 2025 21:48

hehe7318 added the 3.x label Aug 6, 2025

hehe7318 marked this pull request as draft August 6, 2025 21:48

github-advanced-security bot found potential problems Aug 6, 2025

View reviewed changes

Fix codestyle.

efcea00

hehe7318 added the skip-bad-url-suffix-check Skip the checks regarding the bad URL suffix label Aug 7, 2025

hehe7318 and others added 2 commits August 18, 2025 14:29

Merge branch 'develop' into wip/upgrade-connexion-and-werkzeug

1431e95

Meet the format requirement.

feaabd7

hehe7318 changed the title ~~[Draft][develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to 3.1.3 to address CVE~~ [develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to 3.1.3 to address CVE Aug 18, 2025

Remove unused dependencies

a1ea6ca

hehe7318 changed the title ~~[develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to 3.1.3 to address CVE~~ [develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to 3.1.3 to address CVE-2024-34069 Aug 18, 2025

hehe7318 changed the title ~~[develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to 3.1.3 to address CVE-2024-34069~~ [develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to ~=3.0.0 to address CVE-2024-34069 Aug 18, 2025

hehe7318 changed the title ~~[develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to ~=3.0.0 to address CVE-2024-34069~~ [develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to >=3.0.3 to address CVE-2024-34069 Aug 18, 2025

Upgrade Werkzeug to >= 3.0.3. Add changelog message.

f3509b6

hehe7318 marked this pull request as ready for review August 18, 2025 20:35

Merge branch 'develop' into wip/upgrade-connexion-and-werkzeug

d2de8a3

gmarciani reviewed Aug 19, 2025

View reviewed changes

hehe7318 and others added 4 commits August 19, 2025 11:30

Address comments. Mainly rename the old and new JSONEncoder

e75adbb

Changelog revise

4fbfaf6

Upgrade werkzeug to ~=3.1 instead of ~=3.0.3 to address conflicts

41c17e3

Merge branch 'develop' into wip/upgrade-connexion-and-werkzeug

5aa283b

gmarciani approved these changes Aug 22, 2025

View reviewed changes

[develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to >=3.0.3 to address CVE-2024-34069 #6932

Are you sure you want to change the base?

[develop] Upgrade connexion to 2.15.0rc3, upgrade Werkzeug to >=3.0.3 to address CVE-2024-34069 #6932

Uh oh!

Conversation

hehe7318 commented Aug 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of changes

Tests

References

Checklist

Uh oh!

Check failure

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hehe7318 commented Aug 6, 2025 •

edited

Loading