config repo: security vulnerability found in requirement.txt

[Bin Qian]

GitHub reports a security vulnerability found in requirement.txt of config repo.

1 django vulnerability found in …/sysinv/requirements.txt
Remediation
Upgrade django to version 2.2.10 or later. For example:

django>=2.2.10
Always verify the validity and compatibility of suggestions with your codebase.

Details
CVE-2020-7471
moderate severity
Vulnerable versions: >= 2.0.0, < 2.2.10
Patched version: 2.2.10
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

[Ghada Khalil (gkhalil)]

From Al Bailey:
StarlingX ships with python2-django-1.11.20

This vulnerability warning is for Django 1.11 before 1.11.28 allows SQL Injection

So this issue applies to us.

However, we are currently locked based on the “stein” upper constraints which is 1.11.20
https://github.com/openstack/requirements/blob/stable/stein/upper-constraints.txt#L419

Train locks to 1.11.24, but that would also have his CVE violation
https://github.com/openstack/requirements/blob/stable/train/upper-constraints.txt#L507

[Ghada Khalil (gkhalil)]

Marking as low priority given StarlingX needs to use the same constraints as the underlying openstack release and cannot update the package independently due to potential compatibility issues.

[Al Bailey (albailey1974)]

I believe in debian we ship 2.2.28 so this is fixed

 python3-django 2:2.2.28-1~deb11u1 all High-level Python web development framework