Security updates November 2023

Fixes #3796

CHANGELOG.md

@@ -7,7 +7,7 @@ To resolve the Airlock import issue described in ([#3767](https://github.com/mic
 FEATURES:
 
 ENHANCEMENTS:
-
+* Security updates aligning to Dependabot, MS Defender for Cloud and Synk ([#3796](https://github.com/microsoft/AzureTRE/issues/3796))
 BUG FIXES:
 * Update Python packages, and fix breaking changes ([#3764](https://github.com/microsoft/AzureTRE/issues/3764))
 * Enabling support for more than 20 users/groups in Workspace API ([#3759](https://github.com/microsoft/AzureTRE/pull/3759  ))

api_app/requirements.txt

@@ -1,6 +1,6 @@
 # API
 azure-core==1.29.5
-aiohttp==3.8.6
+aiohttp==3.9.0
 azure-cosmos==4.5.1
 azure-identity==1.14.1
 azure-mgmt-cosmosdb==9.3.0

cli/requirements.txt

@@ -8,4 +8,4 @@ pygments==2.16.1
 PyJWT==2.8.0
 azure-cli-core==2.50.0
 azure-identity==1.14.1
-aiohttp==3.8.6
+aiohttp==3.9.0

cli/setup.py

@@ -49,7 +49,7 @@
         "PyJWT==2.8.0",
         "azure-cli-core==2.50.0",
         "azure-identity==1.14.1",
-        "aiohttp==3.8.6"
+        "aiohttp==3.9.0"
     ],
 
     namespace_packages=[],

resource_processor/vmss_porter/requirements.txt

@@ -2,5 +2,5 @@ azure-servicebus==7.11.3
 opencensus-ext-azure==1.1.11
 opencensus-ext-logging==0.1.1
 azure-identity==1.14.1
-aiohttp==3.8.6
+aiohttp==3.9.0
 azure-cli-core==2.50.0

templates/shared_services/certs/terraform/staticweb.tf

@@ -1,13 +1,14 @@
 # See https://microsoft.github.io/AzureTRE/tre-developers/letsencrypt/
 resource "azurerm_storage_account" "staticweb" {
-  name                      = local.staticweb_storage_name
-  resource_group_name       = data.azurerm_resource_group.rg.name
-  location                  = data.azurerm_resource_group.rg.location
-  account_kind              = "StorageV2"
-  account_tier              = "Standard"
-  account_replication_type  = "LRS"
-  enable_https_traffic_only = true
-  tags                      = local.tre_shared_service_tags
+  name                            = local.staticweb_storage_name
+  resource_group_name             = data.azurerm_resource_group.rg.name
+  location                        = data.azurerm_resource_group.rg.location
+  account_kind                    = "StorageV2"
+  account_tier                    = "Standard"
+  account_replication_type        = "LRS"
+  enable_https_traffic_only       = true
+  allow_nested_items_to_be_public = false
+  tags                            = local.tre_shared_service_tags
 
   static_website {
     index_document     = "index.html"

templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/pom.xml

@@ -48,7 +48,7 @@
         <dependency>
             <groupId>com.azure</groupId>
             <artifactId>azure-security-keyvault-secrets</artifactId>
-            <version>4.6.3</version>
+            <version>4.7.2</version>
         </dependency>
         <dependency>
             <groupId>com.azure</groupId>

templates/workspaces/base/terraform/storage.tf

@@ -1,11 +1,12 @@
 resource "azurerm_storage_account" "stg" {
-  name                     = local.storage_name
-  resource_group_name      = azurerm_resource_group.ws.name
-  location                 = azurerm_resource_group.ws.location
-  account_tier             = "Standard"
-  account_replication_type = "GRS"
-  is_hns_enabled           = true
-  tags                     = local.tre_workspace_tags
+  name                            = local.storage_name
+  resource_group_name             = azurerm_resource_group.ws.name
+  location                        = azurerm_resource_group.ws.location
+  account_tier                    = "Standard"
+  account_replication_type        = "GRS"
+  allow_nested_items_to_be_public = false
+  is_hns_enabled                  = true
+  tags                            = local.tre_workspace_tags
 
   lifecycle { ignore_changes = [tags] }
 }