Fix CVE-2024-1135 (backport #3251)

[mergify]

What type of PR?

bug-fix

What does this PR do?

Fix CVE-2024-1135

Related issue(s)

Prerequisites

Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

• In case of feature or enhancement: documentation updated accordingly
• Unless it's docs or a minor change: add changelog entry file.

---

This is an automatic backport of pull request #3251 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 5b5d526 has failed:

On branch mergify/bp/2.0/pr-3251
Your branch is up to date with 'origin/2.0'.

You are currently cherry-picking commit 5b5d526d.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   towncrier/newsfragments/3251.bugfix

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   core/base/requirements-prod.txt

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[mergify]

Thanks for submitting this pull request.
Bors-ng will now build test images. When it succeeds, we will continue to review and test your PR.

bors try

Note: if this build fails, read this.

[bors-mailu]

try

Build failed:

• CI-Done

[nextgens]

bors try

[bors-mailu]

try

Build succeeded:

• CI-Done

[mergify]

bors r+

[bors-mailu]

Timed out.

[nextgens]

bors r+

[bors-mailu]

Build succeeded:

• CI-Done