diff --git a/chromadb/CVE-2026-45829/Dockerfile b/chromadb/CVE-2026-45829/Dockerfile new file mode 100644 index 00000000..fce75614 --- /dev/null +++ b/chromadb/CVE-2026-45829/Dockerfile @@ -0,0 +1,32 @@ +FROM python:3.11-slim + +WORKDIR /app + +# Install native C++ build tools and system dependencies +RUN apt-get update && apt-get install -y --no-install-recommends \ + build-essential \ + g++ \ + python3-dev \ + curl \ + git \ + && rm -rf /var/lib/apt/lists/* + +# Upgrade pip and build tools +RUN pip install --no-cache-dir --upgrade pip setuptools wheel + +# Copy requirements and install all dependencies +COPY requirements.txt . +RUN pip install --no-cache-dir -r requirements.txt + +# Create persistence directory +RUN mkdir -p /chroma/chroma + +# Environment variables +ENV IS_PERSISTENT=TRUE +ENV PERSISTENT_DATA_PATH=/chroma/chroma +ENV ANONYMIZED_TELEMETRY=FALSE + +EXPOSE 7860 + +# Launch server binding to 0.0.0.0:7860 +CMD ["uvicorn", "chromadb.app:app", "--host", "0.0.0.0", "--port", "7860"] diff --git a/chromadb/CVE-2026-45829/README.md b/chromadb/CVE-2026-45829/README.md new file mode 100644 index 00000000..37cff080 --- /dev/null +++ b/chromadb/CVE-2026-45829/README.md @@ -0,0 +1,90 @@ +# ChromaDB Setup & Vulnerability Testing Guide (CVE-2026-45829) + +This repository contains setup configurations and instructions for running both vulnerable and safe (patched) environments for ChromaDB to test CVE-2026-45829. + +--- + +## Overview + +- **Service:** ChromaDB Vector Database +- **Port:** `7860` +- **Persistence:** Enabled (`/chroma/chroma`) +- **Reset Allowed:** `TRUE` + +--- + +## Vulnerable Version (ChromaDB v1.5.8) + +### Setup + +1. Start the vulnerable ChromaDB container: + +```sh +docker compose up -d chromadb-v1.5.8 +``` + +2. Verify that the service is running on `http://localhost:7860`: + +```sh +curl http://localhost:7860/api/v1/heartbeat +``` + +### Environment Configuration + +The vulnerable instance runs with the following configuration: + +- **Image / Build:** Built locally using Python 3.11-slim +- **Command:** `uvicorn chromadb.app:app --host 0.0.0.0 --port 7860` +- **Environment Variables:** + - `IS_PERSISTENT=TRUE` + - `PERSISTENT_DATA_PATH=/chroma/chroma` + - `ALLOW_RESET=TRUE` + - `ANONYMIZED_TELEMETRY=FALSE` + +--- + +## Safe / Patched Version + +### Setup + +To run a patched or updated version of ChromaDB, update your `docker-compose.yml` and `requirements.txt` to use the patched version (e.g., ChromaDB latest/patched release). + +1. Build and start the patched container: + +```sh +docker compose up -d chromadb-patched +``` + +2. Verify that the patched service is running on `http://localhost:7861` (or your configured port): + +```sh +curl http://localhost:7861/api/v1/heartbeat +``` + +--- + +## Docker & Local Commands Reference + +### Building Containers +```sh +docker compose build +``` + +### Starting Containers in Background +```sh +docker compose up -d +``` + +### Viewing Container Logs +```sh +docker compose logs -f chromadb-v1.5.8 +``` + +### Stopping Services +```sh +docker compose down +``` + +### Resetting Persistent Data Volume +```sh +docker volume rm _chroma_data diff --git a/chromadb/CVE-2026-45829/docker-compose.yml b/chromadb/CVE-2026-45829/docker-compose.yml new file mode 100644 index 00000000..a628adb5 --- /dev/null +++ b/chromadb/CVE-2026-45829/docker-compose.yml @@ -0,0 +1,18 @@ +services: + chromadb-v1.5.8: + build: . + container_name: chromadb_vulnerable_test + # Explicitly run your mandatory uvicorn command + command: uvicorn chromadb.app:app --host 0.0.0.0 --port 7860 + ports: + - "7860:7860" + environment: + - IS_PERSISTENT=TRUE + - PERSISTENT_DATA_PATH=/chroma/chroma + - ALLOW_RESET=TRUE + - ANONYMIZED_TELEMETRY=FALSE + volumes: + - chroma_data:/chroma/chroma + +volumes: + chroma_data: diff --git a/chromadb/CVE-2026-45829/requirements.txt b/chromadb/CVE-2026-45829/requirements.txt new file mode 100644 index 00000000..6554790f --- /dev/null +++ b/chromadb/CVE-2026-45829/requirements.txt @@ -0,0 +1,49 @@ +# --- Core ChromaDB & Server Engine --- +chromadb==1.5.8 +fastapi>=0.95.0,<1.0.0 +uvicorn[standard]>=0.20.0,<0.31.0 +pydantic>=2.0.0,<3.0.0 +pydantic-settings>=2.0.0 +starlette>=0.27.0 + +# --- OpenTelemetry & Telemetry (Fixes ModuleNotFoundError) --- +opentelemetry-api>=1.2.0 +opentelemetry-sdk>=1.2.0 +opentelemetry-exporter-otlp-proto-grpc>=1.2.0 +opentelemetry-instrumentation>=0.41b0 +opentelemetry-instrumentation-fastapi>=0.41b0 + +# --- Vector Search & Storage Backends --- +hnswlib>=0.7.0 +chroma-hnswlib>=0.7.3 +clickhouse-connect>=0.5.0 +posthog>=3.0.0 +overrides>=7.3.1 +onnxruntime>=1.14.0 + +# --- Machine Learning & HuggingFace Model Pipeline --- +torch>=2.0.0 --extra-index-url https://download.pytorch.org/whl/cpu +transformers>=4.30.0 +sentence-transformers>=2.2.0 +tokenizers>=0.13.0 +huggingface-hub>=0.14.0 +safetensors>=0.3.0 + +# --- Scientific Computing & Utilities --- +numpy>=1.22.0,<2.0.0 +scipy>=1.10.0 +scikit-learn>=1.2.0 +pandas>=1.5.0 +tqdm>=4.65.0 +requests>=2.28.0 +urllib3>=1.26.0,<3.0.0 +httpx>=0.24.0 +typing-extensions>=4.5.0 +pyyaml>=6.0 +pypika>=0.48.9 +mmh3>=4.0.1 +orjson>=3.9.12 +tenacity>=8.2.3 +typer>=0.9.0 +rich>=10.11.0 +build>=1.0.3