[Anaconda] - Cryptography - Patch security vulnerability - GHSA-3ww4-…

…gg4f-jr7f (#964)

src/anaconda/.devcontainer/Dockerfile

@@ -7,9 +7,7 @@ RUN . /etc/os-release && if [ "${VERSION_CODENAME}" != "bullseye" ]; then exit 1
 # They are installed by the base image (continuumio/anaconda3) which does not have the patch.
 RUN conda install \
     # https://github.com/advisories/GHSA-v845-jxx5-vc9f
-    urllib3==1.26.18 \
-    # https://github.com/advisories/GHSA-jfhm-5ghh-2f97
-    cryptography==41.0.7
+    urllib3==1.26.18
 
 RUN python3 -m pip install --upgrade \
     # https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21797
@@ -37,7 +35,9 @@ RUN python3 -m pip install --upgrade \
     # https://github.com/advisories/GHSA-44cc-43rp-5947
     jupyterlab==4.0.11 \
     # https://github.com/advisories/GHSA-5h86-8mv2-jq9f
-    aiohttp==3.9.2
+    aiohttp==3.9.2 \
+    # https://github.com/advisories/GHSA-3ww4-gg4f-jr7f
+    cryptography==42.0.0
 
 # Reset and copy updated files with updated privs to keep image size down
 FROM mcr.microsoft.com/devcontainers/base:1-bullseye

src/anaconda/test-project/test.sh

@@ -40,7 +40,7 @@ checkPythonPackageVersion "nbconvert" "6.5.1"
 checkPythonPackageVersion "werkzeug" "2.2.3"
 checkPythonPackageVersion "certifi" "2022.12.07"
 checkPythonPackageVersion "requests" "2.31.0"
-checkPythonPackageVersion "cryptography" "41.0.7"
+checkPythonPackageVersion "cryptography" "42.0.0"
 checkPythonPackageVersion "transformers" "4.36.0"
 checkPythonPackageVersion "mpmath" "1.3.0"
 checkPythonPackageVersion "aiohttp" "3.9.2"
@@ -51,7 +51,6 @@ checkPythonPackageVersion "pillow" "10.2.0"
 checkPythonPackageVersion "jupyterlab" "4.0.11"
 
 checkCondaPackageVersion "pyopenssl" "23.2.0"
-checkCondaPackageVersion "cryptography" "41.0.7"
 checkCondaPackageVersion "requests" "2.31.0"
 checkCondaPackageVersion "pygments" "2.15.1"
 checkCondaPackageVersion "mpmath" "1.3.0"