BentoML

hi, are there any plans for removing the critical vulnerability published two weeks ago? <https://github.com/advisories/GHSA-9g44-gwvm-hc44>

only affects bentoml versions between 1.2 and 1.3.4.post1

This is also serialization in between API server and runner, thus not exposed externally unless user explicitly do so

could you point me to the specific commit that fixed it?

Hello, I think there might be a miscommunication. Chaoyu might be referring to and older CVE. For this one, our team had a discussion to remove these CLI commands which was originally not intended for public use anyways, namely `start-http-server`  and `start-runner-server`

Is this CVE affecting your use cases?

Yes, the attack surface is when you manually use the `start-*` command to start dependent services individually and expose them publicly.
If not, or if you are deploying on bentocloud, you are not affected.