[BUG][opensearch-dashboards:2.25.0]

[shashank-shridhar]

Hello,
Our security scans detected some security vulnerabilities in the Opensearch Dashboards No Security and Opensearch Project.

Following are the CVE numbers:

OS DASHBOARDS NO SECURITY
CVE-2023-45857
CVE-2024-21538
CVE-2024-6232

Opensearch Project Opensearch

CVE-2024-47535
CVE-2024-35195

Is there any timeline or plan as to address these vulnerabilities?

Thanks in advance.

[dblock]

[Catch All Triage - 1, 2, 3, 4, 5, 6]

[seraphjiang]

@shashank-shridhar

I could help to answer the OpenSearch Dashboards part.

• [CVE-2024-21538] Bump cross-spawn from 6.0.5 and 7.0.3 to 7.0.5 (#8882)
• [CVE-2023-45857] Bump axios from 0.27.2 to 1.6.1 (#5470)

CVE-2024-39338 There is a MEDIUM severity vulnerability affecting CPython. that is not part of OpenSearch Dashboards distribution.