experimental[major]: CVE-2024-46946 fix #26783
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
dosubot
bot
added
size:S
dosubot
bot
added
size:M
eyurtsev
reviewed
Sep 24, 2024
| "exp": sympy.exp, | ||
| "log": sympy.log, | ||
| "ln": sympy.log, # natural log (alias) | ||
| "log10": sympy.log, # log base 10 (use sympy.log) |
There was a problem hiding this comment.
both log10 and ln are aliased to sympy.log
There was a problem hiding this comment.
changed so that log would be a user defined base (default 10), ln will be regular sympy log which defaults to ln. And log 10 to base 10
eyurtsev
reviewed
Sep 24, 2024
eyurtsev
reviewed
Sep 24, 2024
libs/experimental/langchain_experimental/llm_symbolic_math/base.py
Outdated
Show resolved
Hide resolved
eyurtsev
approved these changes
Sep 24, 2024
dosubot
bot
added
the
lgtm
eyurtsev
changed the title
|
@mercyspirit I'm going to make the fix backwards compatible for users that are using this code for prototyping since this fix will break a lot of functionality otherwise. |
dosubot
bot
added
size:L
|
This PR resolves this discussion: #26720. |
Sheepsta300
pushed a commit
to Sheepsta300/langchain
that referenced
this pull request
Oct 1, 2024
Description: Resolve CVE-2024-46946 by switching out sympify with parse_expr with a very specific allowed set of operations. https://nvd.nist.gov/vuln/detail/cve-2024-46946 Sympify uses eval which makes it vulnerable to code execution. parse_expr is limited to specific expressions. Bandit results  --------- Co-authored-by: aqiu7 <[email protected]> Co-authored-by: Eugene Yurtsev <[email protected]> Co-authored-by: Eugene Yurtsev <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description: Resolve CVE-2024-46946 by switching out sympify with parse_expr with a very specific allowed set of operations.
https://nvd.nist.gov/vuln/detail/cve-2024-46946
Sympify uses eval which makes it vulnerable to code execution. parse_expr is limited to specific expressions.
Bandit results
