[miniconda] Patch Python due to GHSA-5cpq-8wj7-hf2v

src/miniconda/.devcontainer/Dockerfile

@@ -41,9 +41,16 @@ RUN if [ -f "/tmp/conda-tmp/environment.yml" ]; then umask 0002 && /opt/conda/bi
 
 # Temporary: Upgrade python packages due to mentioned CVEs
 # They are installed by the base image (continuumio/miniconda3) which does not have the patch.
-RUN python3 -m pip install --upgrade \
+RUN conda update -y conda \
+    # uninstall vulnerable packages 
+    && python3 -m pip uninstall --yes \
+    cryptography \
+    && python3 -m pip install --upgrade \
     # https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32681
-    requests
+    requests \
+    # https://github.com/pyca/cryptography/security/advisories/GHSA-5cpq-8wj7-hf2v
+    pyopenssl \
+    cryptography
 
 # [Optional] Uncomment this section to install additional OS packages.
 # RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \

src/miniconda/test-project/test-utils.sh

@@ -172,3 +172,11 @@ checkPythonPackageVersion()
     current_version=$(python -c "import ${PACKAGE}; print(${PACKAGE}.__version__)")
     check-version-ge "${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
 }
+
+checkCondaPackageVersion()
+{
+    PACKAGE=$1
+    REQUIRED_VERSION=$2
+    current_version=$(conda list "${PACKAGE}" | grep -w "${PACKAGE}" | awk '{print $2}')
+    check-version-ge "conda-${PACKAGE}-requirement" "${current_version}" "${REQUIRED_VERSION}"
+}

src/miniconda/test-project/test.sh

@@ -18,11 +18,17 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont
 
 check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"
 
-checkPythonPackageVersion "cryptography" "38.0.3"
+checkPythonPackageVersion "cryptography" "41.0.0"
 checkPythonPackageVersion "setuptools" "65.5.1"
 checkPythonPackageVersion "wheel" "0.38.1"
 checkPythonPackageVersion "requests" "2.31.0"
 
+checkCondaPackageVersion "cryptography" "41.0.0"
+checkCondaPackageVersion "pyopenssl" "23.2.0"
+checkCondaPackageVersion "setuptools" "65.5.1"
+checkCondaPackageVersion "wheel" "0.38.1"
+checkCondaPackageVersion "requests" "2.31.0"
+
 check "conda-update-conda" bash -c "conda update -y conda"
 check "conda-install" bash -c "conda install -c conda-forge --yes tensorflow"
 check "conda-install" bash -c "conda install -c conda-forge --yes pytorch"