fix: upstream Python CVE vulnerabilities in Duo Auth Proxy 6.6.0 #44
Description
Description
Duo Auth Proxy 6.6.0 bundles Python dependencies with known CVEs. These cannot be fixed on our side — they require an upstream fix from Cisco/Duo.
Affected CVEs
| CVE | Package | Severity | Description |
|---|---|---|---|
| CVE-2026-24049 | wheel | HIGH | Privilege Escalation via malicious wheel file unpacking |
| CVE-2026-26007 | cryptography | HIGH | Subgroup Attack due to missing validation for SECT curves |
| CVE-2026-23949 | jaraco.context | HIGH | Path traversal via malicious tar archives |
Current Status
- Alerts dismissed as "won't fix" with comment referencing upstream dependency
- Monitoring Duo Auth Proxy releases for updates
Action Items
- Monitor Duo Auth Proxy release notes for new version
- Rebuild image when new Duo version addresses these CVEs
- Re-run Trivy scan to verify fix