Any details on the fix for on CVE <https://github....
# ask-for-helpj
Jerry Harrow
04/17/2025, 5:44 PMAny details on the fix for on CVE https://github.com/bentoml/BentoML/security/advisories/GHSA-7v4r-c989-xh26 ?
Can you point out the fix made in 1.4.8 that resolved it.
Looking to mitigate that CVE in our use of bentoml. We are stuck on bentoml==1.1.11 due to our use of openllm==0.4.44 — so need to figure out a workaround.
c
Chaoyu
04/17/2025, 6:02 PMThis issue doesn’t really affect regular use.. there’s no need to upgrade just because of this
Chaoyu
04/17/2025, 6:03 PMIt’s only a risk if user uses a BentoML internal api in a very specific undocumented way
Chaoyu
04/17/2025, 6:04 PMEssentially the start-runner-server cli command is not used in any critical path
j
Jerry Harrow
04/17/2025, 6:08 PMThanks that is helpful.
So only related to using start-runner-server (which isn’t even documented in the toplevel 1.1.11 CLI help — though I see it is there if you explicitly type it)?
So if we are just using
openllm serve {model}c
Chaoyu
04/17/2025, 6:16 PMThat’s correct
gratitude thank you 1