GithubHelp home page GithubHelp logo

seagate / cortx-test Goto Github PK

View Code? Open in Web Editor NEW
13.0 9.0 56.0 17.85 MB

Cortx-Test is automated system and end to end test cases repository and includes distributed automated testing framework and pluggable tools developed to ensure functional and performance test coverage of the CORTX object storage.

Home Page: https://github.com/Seagate/cortx

License: GNU Affero General Public License v3.0

Python 96.51% RobotFramework 2.52% Shell 0.39% Groovy 0.47% Makefile 0.12%
testing-tools testing-framework testing object s3 s3-storage

cortx-test's Introduction

Disclaimer: This project is not maintained anymore

cortx-test

CORTX-TEST is a repository for multiple automation projects developed for testing CORTX and supported solutions/systems. These frameworks are reusable for any opensource object stores with minimal configurations.

It is logically divided into following components:

  • Test Automation framework (Corbot)
  • Test Execution Framework (Gliese entry point- drunner)
  • Robot framework UI Tests and
  • Tools ( Reporting Dashboards, Data Integrity, Clone Test Plans etc.)

Architectural Overview page describes the architectural considerations and repository layout. Test Execution Deployment View describes the deployment design view of the test framework in distributed mode. Test Framework Design Document describes in details the design of the framework in distributed mode.

Getting Started

This document assumes that you are aware about Github and if you are coming from SVN or other code versioning system it is recommended to follow the link Github Process Readme to configure git on your local machine. Following Readme document will give you enough insights to start contributing.

You need a separate client VM with any Linux flavour (prefer CentOS 7+ ) to install client side pre-requisites and start running automation framework on the same VM. This VM should have network connectivity to a Cortx Cluster OR CORTX OVA deployment. Alternatively you may use one of the nodes as client (less recommended).

Git process

Typically, a member contributing to test framework would follow the review process as follows:

  1. Commits happen on your forked repository(origin).
  2. Then you can raise a PR to merge it to Seagate Cortx-Test repository (Upstream). PRs can be raised even if you have read-only access to Seagate Repositories.
  3. Moderators of Cortx-Test can create server side feature branch if multiple developers are working on same feature branch
  4. Team member can check-in and raise the PR to upstream feature branch. Feature lead would raise the pull request to main.

Get the Sources

Fork local repository from Seagate's Cortx-Test repository and then clone Cortx-Test repository from Seagate repository. Commands as follows:

git clone https://github.com/Seagate/cortx-test.git
cd cortx-test/
git status
git branch
git checkout main
git remote -v
git remote add upstream https://github.com/Seagate/cortx-test.git
git remote -v

Issuing the above command again will return output as shown:

> origin    https://github.com/YOUR_USERNAME/cortx-test.git (fetch)
> origin    https://github.com/YOUR_USERNAME/cortx-test.git (push)
> upstream        https://github.com/Seagate/cortx-test.git (fetch)
> upstream        https://github.com/Seagate/cortx-test.git (push)

Then fetch upstream...

git fetch upstream
git pull upstream main

Setting up dev environment

Following steps help in setting up client side env, where test framework will run. These steps assume that you have followed earlier process (i.e. git client is installed and Cortx-test is cloned)

1. `yum update -y`

2. `yum install -y gcc openssl-devel bzip2-devel libffi-devel zlib-devel wget make sqlite-devel`

3. `cd /usr/src && wget https://www.python.org/ftp/python/3.7.9/Python-3.7.9.tgz && tar xzf Python-3.7.9.tgz && rm Python-3.7.9.tgz`

4. `cd /usr/src/Python-3.7.9 && ./configure --prefix=/usr --enable-optimizations`
4a. Note if you get an error message:
configure: error: in `/usr/src/Python-3.7.9':
configure: error: no acceptable C compiler found in $PATH
See `config.log' for more details
You need to install gcc:
- Redhat base:
`yum groupinstall "Development Tools"`
- Debian base:
`apt-get install build-essential`
- openSUSE base:
`zypper install --type pattern devel_basis`

5. `cd /usr/src/Python-3.7.9 && make altinstall`
5a. Right here at this point you can check python is installed correctly by going in interactive mode. You can issue command "pip3 install pysqlite3" and type "import sqlite3" to confirm that sqlite3 is installed. This will save a lot of your time if you run into issues later for python installation. In some linux flavours you need --enable-loadable-sqlite-extensions switch to be added while configuring python.   
cd /usr/src/Python-3.7.9 && ./configure --prefix=/usr --enable-optimizations --enable-loadable-sqlite-extensions

6. Create a softlink to point to this installation. You can check the folder created and 
improvise following command.
   `ln -s /usr/local/bin/python3.7 python3.7

7. `yum install -y python3-devel librdkafka nfs-utils python3-tkinter`

8. `python3.7 -m venv virenv`

9. `source virenv/bin/activate` or use old style `. ./virenv/bin/activate`
  
8. `pip install --upgrade pip`

9. `pip install pysqlite3`

10. Change dir to cortx-test project directory, make sure a requirement file is present in project dir. Use following command to install python packages.
`pip install --ignore-installed -r requirements.txt`
You can issue virenv/bin/deactivate to deactivate pyenv.

11. Install awscli with default python 3.6 pre installed with inhouse vm images and 
configure aws and copy cert file.

Alternatively by skipping step 8 to 10, you can also set python environment by using virtual env.

Script to set up client environment (Alternate option to manual steps)

Change dir to your local repository root folder. If you have checked out your code in clean_dev directory created in your home on Linux machine (RHEL Flavour), then /home/<yourname>/clean_dev is the local repository root folder.

 # cd clean_dev
 # ./cortx-test/ci_tools/client_setup.sh 

This script should handle client setup. However, note that python configures does not have switch --enable-loadable-sqlite-extensions in script.

Steps to copy certificate

mkdir -p /etc/ssl/stx

mkdir -p /etc/ssl/stx-s3-clients/s3/

curl https://raw.githubusercontent.com/Seagate/cortx-s3server/kubernetes/scripts/haproxy/ssl/s3.seagate.com.crt -o /etc/ssl/stx-s3-clients/s3/ca.crt

curl https://raw.githubusercontent.com/Seagate/cortx-prvsnr/4c2afe1c19e269ecb6fbf1cba62fdb7613508182/srv/components/misc_pkgs/ssl_certs/files/stx.pem -o /etc/ssl/stx/stx.pem

Steps to set up s3 client

To set up s3 client tools, make sure you have completed basic setup in Set up dev environment.
Script in project's root folder cortx-test scripts/s3_tools/Makefile can be used to install s3 tools on client.

Required arguments in configuration:
    ACCESS aws_access_key_id
    SECRET aws_secret_access_key
optional arguments:
    -i --ignore-errors  Ignore all errors in commands executed to remake files.
    -k --keep-going     Continue as much as possible after an error.
    --ENDPOINT=s3_endpoint
    --CA_CRT=certificate_file_path
    --NFS_SHARE=NFS_share_jclient_path
    --APACHE_J_METER=apache-jmeter-5.4.1.tgz
    --VERIFY_SSL='True' This is used to whether https/ssl be used or not
    --VALIDATE_CERTS='True' This is used whether given certificate should be verified or not.
    

make help --makefile=scripts/s3_tools/Makefile
    all           : Install & configure tools like aws, s3fs, s3cmd, minio, call in case it's a new machine. Eg: make all ACCESS=<new-accesskey> SECRET=<new-secretkey>
    clean         : Remove installed tools like aws, s3fs, s3cmd, minio. Eg: make clean
    install-tools : Install tools like aws, s3fs, s3cmd, minio, call in case it's a new machine. Eg: make install-tools
    configure-tools: Install tools like aws, s3fs, s3cmd, minio, call in case it's a new machine. Eg: make configure-tools ACCESS=<new-accesskey> SECRET=<new-secretkey>
    aws          : Install & configure aws tool. Eg: make aws ACCESS=<new-accesskey> SECRET=<new-secretkey>
    s3fs         : Install & configure s3fs tool. Eg: make s3fs ACCESS=<new-accesskey> SECRET=<new-secretkey>
    s3cmd        : Install & configure s3cmd tool. Eg: make s3cmd ACCESS=<new-accesskey> SECRET=<new-secretkey>
    jcloud-client: Setup jcloud-client. Eg: make jcloud-client
    minio        : Install & configure minio tool. Eg: make minio ACCESS=<new-accesskey> SECRET=<new-secretkey>
    s3bench-install: Setup s3bench tool. Eg: make s3bench-install --makefile=<makefile_path>"
	apache-jmeter-install: Setup apache-jmeter-install tool. Eg: make apache-jmeter-install --makefile=<makefile_path>"
    bashrc-configure : Configure ~/.bashrc for updating ulimit -n for allowing file descriptors 
    
To increase ulimit for allowing maximum file descriptors
make bashrc-configure

To install & configure all tools:
make all --makefile=scripts/s3_tools/Makefile ACCESS=<aws_access_key_id> SECRET=<aws_secret_access_key> ENDPOINT=<lb ipaddress> VALIDATE_CERTS=<Tree/False> VERIFY_SSL=<True/False>

To just configure installed tools:
make configure-tools --makefile=scripts/s3_tools/Makefile ACCESS=<aws_access_key_id> SECRET=<aws_secret_access_key> ENDPOINT=<lb ipaddress> VALIDATE_CERTS=<Tree/False> VERIFY_SSL=<True/False>

To install & configure specific tool(i.e aws):
make aws --makefile=scripts/s3_tools/Makefile ACCESS=<aws_access_key_id> SECRET=<aws_secret_access_key> ENDPOINT=<lb ipaddress> VALIDATE_CERTS=<Tree/False> VERIFY_SSL=<True/False>

To just configure specific tool(i.e. aws):
make aws-configure --makefile=scripts/s3_tools/Makefile ACCESS=<aws_access_key_id> SECRET=<aws_secret_access_key> ENDPOINT=<lb ipaddress> VALIDATE_CERTS=<Tree/False> VERIFY_SSL=<True/False>

To clean up all tools:
make clean --makefile=scripts/s3_tools/Makefile

MongoDB as Configuration Management Database

Cortx-test uses MongoDB as backend to store Cortx setup details. These details, stored in MongoDB, are specific to the setup itself. The purpose of this setup is to do automatic config generation based on the setup. Not all values are mandatory and only applicable values needs to be filled in vm environment. A sample template is as shown below. This template is fed to the database and pulled when developer will run test automation with test runner. The pulled templates merge with static yaml files to build the CMN_CFG and other component level configs. If you don't want to store or use MongoDB configuration entry, you may create setups.json locally in project root cortx-test whch will be used to build and load configs in test run process. While testing with cortx-test in dev environment or Community you may like to have setups.json created and skip MongoDB interaction.

Setups.json format is shown below. Sample MongoDB entry under A sample MongoDB entry for a target setup. is placed in value part of LC_Setup dict shown below.

{"LC_Setup": { 
            }

}

A sample MongoDB entry for a target setup.

{
    "setupname":"LC_Setup",
    "setup_type":"VM",
    "setup_in_useby": "",
    "in_use_for_parallel": false,
    "parallel_client_cnt": 0,
    "is_setup_free": true,
    "product_family": "LC",
    "s3_engine": 1,
    "product_type": "k8s",
    "lb": "FQDN without protocol(http/s)",
    "nodes":[
        {
            "host": "srv-node-0",
            "hostname": "node 0 hostname",
            "ip": "node 0 ip",
            "fqdn": "node 0 fqdn",
            "username": "node 0 username",
            "password": "node 0 password",
            "public_data_ip":"",
            "private_data_ip":"",
            "node_type":"master",
            "lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "encl_lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "encl_rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "gem_controller": {
                "ip": "",
                "user": "",
                "pwd": "",
                "port1": "",
                "port2": ""
                }
        },
        {
            "host": "srv-node-1",
            "hostname": "node 1 hostname",
            "ip": "node 1 ip address",
            "fqdn": "node 0 fqdn",
            "username": "node 1 username",
            "password": "node 1 password",
            "public_data_ip":"",
            "private_data_ip":"",
            "node_type":"worker",
            "lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "encl_lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "encl_rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "gem_controller": {
                "ip": "",
                "user": "",
                "pwd": "",
                "port1": "",
                "port2": ""
                }
        },
        {
            "host": "srv-node-2",
            "hostname": "node 2 hostname",
            "ip": "node 2 ip address",
            "fqdn": "node 0 fqdn",
            "username": "node 2 username",
            "password": "node 2 password",
            "public_data_ip":"",
            "private_data_ip":"",
            "node_type":"worker",
            "lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
            },
            "rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
            },
            "encl_lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
            },
            "encl_rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
            },
            "gem_controller": {
                "ip": "",
                "user": "",
                "pwd": "",
                "port1": "",
                "port2": ""
            }
        }
    ],
    
    "csm":
    {
      "mgmt_vip": "fqdn",
      "port": "31169",
      "csm_admin_user":{
        "username": "",
        "password": ""
      }
    },
    "bmc":
    {
        "username": "",
        "password": ""
    },
    "s3endpoints":
    {
        "s3_io": "fqdn:port",
        "s3_auth": "fqdn:port"
    }
}

Following json shows a minimal example setup configuration. You may want to refer full json at tools/setup_update/setup_entry_lc.sample.json.

{
    "setupname":"Unique_name/FQDN",
    "setup_type":"VM",
    "product_family": "LC",
    "product_type": "k8s",
    "s3_engine": 2,
    "lb": "FQDN of LB or K8S SVC",
    "nodes":[
        {
            "host": "srv-node-0",
            "hostname": "FQDN",
            "ip": "IPV4",
            "fqdn": "FQDN",
            "username": "root",
            "password": "",
            "public_data_ip":"",
            "private_data_ip":"",
            "node_type":"master",
            "lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "encl_lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "encl_rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "gem_controller": {
                "ip": "",
                "user": "",
                "pwd": "",
                "port1": "",
                "port2": ""
                }
        },
        {
            "host": "srv-node-1",
            "hostname": "FQDN",
            "ip": "IPV4",
            "fqdn": "FQDN",
            "username": "root",
            "password": "",
            "public_data_ip":"",
            "private_data_ip":"",
            "node_type":"worker",
            "lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "encl_lpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "encl_rpdu": {
                "ip": "",
                "port": "",
                "user": "",
                "pwd": ""
                 },
            "gem_controller": {
                "ip": "",
                "user": "",
                "pwd": "",
                "port1": "",
                "port2": ""
                }
        }
        
    ],
    
    "csm":
    {
      "mgmt_vip": "FQDN",
      "port": "31169",
      "csm_admin_user":{
        "username": "<csm_uid>",
        "password": ""
      }
    },
    "bmc":
    {
        "username": "",
        "password": ""
    }
}

Script in project's path tools/setup_update can be used to generate a setup specific config entry.

python setup_entry.py --help

usage: setup_entry.py [-h] [--fpath FPATH] [--dbuser DBUSER] [--dbpassword DBPASSWORD] [--new_entry NEW_ENTRY]


Update the setup entry

optional arguments:
  -h, --help            show this help message and exit
  --fpath FPATH         Path of the json entry file
  --dbuser DBUSER       Database user
  --dbpassword DBPASSWORD
                        database password
  --new_entry NEW_ENTRY
                        True for new entry , False for update

e.g. python3 tools/setup_update/setup_entry.py --dbuser <> --dbpassword <>

Name of setup specified in json file should be unique in case you are creating a new setup.
For example in sample json setupname value should be unique `"setupname":"T2"`.

Steps to run test automation locally

Run Cortx tests with test runner

If you want to anyway run the parallel tests sequentially. You should use --force_serial_run switch as shown in following command.

python -u testrunner.py -te TEST-17412  -tp TEST-18382 --target s3-vm-2928 --force_serial_run True

If you want to run your test plan and TE ticket with test runner, you should skip --force_serial_run switch.

python -u testrunner.py -te TEST-17412  -tp TEST-18382 --target s3-vm-2928

When you want to run test and don't want to update Report DB or JIRA

python -u testrunner.py -te TEST-17412  -tp TEST-18382 --target s3-vm-2928 --force_serial_run true --db_update False --jira_update False

Test runner help

python -u testrunner.py --help

usage: testrunner.py [-h] [-j JSON_FILE] [-r HTML_REPORT] [-d DB_UPDATE]
                      [-u JIRA_UPDATE] [-te TE_TICKET] [-pe PARALLEL_EXE]
                      [-tp TEST_PLAN] [-b BUILD] [-t BUILD_TYPE] [-tg TARGET]
                      [-ll LOG_LEVEL] [-p PRC_CNT] [-f [FORCE_SERIAL_RUN]]
                      [-i DATA_INTEGRITY_CHK]
 
 optional arguments:
   -h, --help            show this help message and exit
   -j JSON_FILE, --json_file JSON_FILE
                         json file name
   -r HTML_REPORT, --html_report HTML_REPORT
                         html report name
   -d DB_UPDATE, --db_update DB_UPDATE
                         Update Reports DB. Can be false in case reports db is
                         down
   -u JIRA_UPDATE, --jira_update JIRA_UPDATE
                         Update Jira. Can be false in case Jira is down
   -te TE_TICKET, --te_ticket TE_TICKET
                         jira xray test execution id
   -pe PARALLEL_EXE, --parallel_exe PARALLEL_EXE
                         parallel_exe: True for parallel, False for sequential
   -tp TEST_PLAN, --test_plan TEST_PLAN
                         jira xray test plan id
   -b BUILD, --build BUILD
                         Build number
   -t BUILD_TYPE, --build_type BUILD_TYPE
                         Build type (Release/Dev)
   -tg TARGET, --target TARGET
                         Target setup details
   -ll LOG_LEVEL, --log_level LOG_LEVEL
                         log level value
   -p PRC_CNT, --prc_cnt PRC_CNT
                         number of parallel processes
   -f [FORCE_SERIAL_RUN], --force_serial_run [FORCE_SERIAL_RUN]
                         Force sequential run if you face problems with
                         parallel run
   -i DATA_INTEGRITY_CHK, --data_integrity_chk DATA_INTEGRITY_CHK
                         Helps set DI check enabled so that tests perform
                         additional checksum check
   -pf PRODUCT_FAMILY, --product_family
                        Helps to select product family type whether LR or local
   -c  VALIDATE_CERTS, --validate_certs
                        This gives option whetherValidate HTTPS/SSL certificate 
                        to S3 endpoint needs to be validated or not.
   -s USE_SSL,  --use_ssl
                     Option whether HTTPS/SSL connection for S3 endpoint should be used or not.
   -csm CSM_CHECKS,  --csm_checks
                     Execute tests with error code & msg check enabled.
   -hc HEALTH_CHECK --health_check
                     Decide whether to do health check (on server) or not with tests execution.

Running Test locally in distributed mode

pytest --local=True -d --tx 3*popen -rA unittests\Your_Test_Module.py
3 is number of worker processes to be spawned.

Running test plans in dev environment

With dist mode
pytest --capture=no --te_tkt TEST-17412 -d --tx 2*popen -rA unittests\Your_Test_Module.py

With sequential execution
pytest --capture=no --te_tkt TEST-17412 -rA unittests\test_reporting_and_logging_hooks.py

Client Hardware Configuration

While ordering client on ssc-cloud, make sure 1. Have at least 8GB RAM for it, to support 1GB object size in s3bench tests. 2. For more large number of parallel IO connections, good to have 8 CPUs. 3. Default 1GB of swap space is provided, need to order 1 extra disk, and create swap space out of extra disk, and mount it. Procedure to create swap space of 8 GB: A gist from one of the articles * Create new partition using fdisk command * fdisk /dev/sdb # sda will generally have OS installation * new (option n), primary (option p) partition, Default partition number, Default first sector, Last Sector +8G, Write (option w) * Create swap on the partition using mkswap /dev/sdb1 # Provide above created partition number i.e. sdb1 * Mount swap using swapon /dev/sdb1

## Increase client root space size should be at least 50 GB using following commands
Please utilize free disks from the output of lsblk
Note: In case of multipart/Big object upload, disk space requirement may change/increase.
resize2fs is specific to ext2/3/4. In case /root is formatted with xfs we need to use the xfs_growfs tool 
e.g. "xfs_growfs /dev/mapper/vg_sysvol-lv_root"
We can run lvextend as "lvextend /dev/mapper/vg_sysvol-lv_root -l +100%FREE" to consume all the free PE
```
df -h
lsblk 
pvcreate /dev/sdb
vgextend vg_sysvol /dev/sdb
lvextend /dev/mapper/vg_sysvol-lv_root -L +50G
resize2fs /dev/mapper/vg_sysvol-lv_root
df -h
```

## increase the swap space, Please utilize free disks from the output of lsblk
```
lsblk 
pvcreate /dev/sdi
vgextend vg_sysvol /dev/sdi
lvextend /dev/mapper/vg_sysvol-lv_swap -l +100%FREE
swapoff /dev/mapper/vg_sysvol-lv_swap
mkswap /dev/mapper/vg_sysvol-lv_swap
swapon /dev/mapper/vg_sysvol-lv_swap
```

cortx-test's People

Contributors

aayushisharma88 avatar aditipande96 avatar akshaym99 avatar ankita-93 avatar apoorva-rao avatar apurwamohite avatar archanabpatil avatar ashish-seagate avatar ashukakkar avatar ashwinis-borse avatar bhairavi22 avatar dhananjayd1 avatar dhobalevishal avatar gaurkrgaurav avatar kachhwahadivya avatar ketanarlulkar avatar kulrk avatar niteshmahajan avatar pragamj avatar priyankaborawake avatar rahul-hatwar avatar rajeshpratapsinghchouhan avatar sampadap03 avatar seagate-sarang-sawant avatar sonalk0209 avatar subham-pattanaik avatar swanand-gadre avatar swapnil-khandare avatar vikaskumarc avatar zohebkhann avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

cortx-test's Issues

CVE-2022-40897 (Medium) detected in setuptools-41.6.0-py2.py3-none-any.whl

CVE-2022-40897 - Medium Severity Vulnerability

Vulnerable Library - setuptools-41.6.0-py2.py3-none-any.whl

Easily download, build, install, upgrade, and uninstall Python packages

Library home page: https://files.pythonhosted.org/packages/d9/de/554b6310ac87c5b921bc45634b07b11394fe63bc4cb5176f5240addf18ab/setuptools-41.6.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/switch,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • setuptools-41.6.0-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

Publish Date: 2022-12-23

URL: CVE-2022-40897

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/

Release Date: 2022-12-23

Fix Resolution: 65.5.1


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-28493 (Medium) detected in Jinja2-2.10.1-py2.py3-none-any.whl - autoclosed

CVE-2020-28493 - Medium Severity Vulnerability

Vulnerable Library - Jinja2-2.10.1-py2.py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/1d/e7/fd8b501e7a6dfe492a433deb7b9d833d39ca74916fa8bc63dd1a4947a671/Jinja2-2.10.1-py2.py3-none-any.whl

Path to dependency file: /libs/csm/csm

Path to vulnerable library: /libs/csm/csm,/requirements.txt,/switch,/requirements.txt

Dependency Hierarchy:

  • Jinja2-2.10.1-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: ef77fa6ea195cb251a124be382b5c33f280e7db1

Found in base branch: main

Vulnerability Details

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the _punctuation_re regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

Publish Date: 2021-02-01

URL: CVE-2020-28493

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28493

Release Date: 2021-02-01

Fix Resolution: Jinja2 - 2.11.3


⛑️ Automatic Remediation is available for this issue

CVE-2022-36087 (Medium) detected in oauthlib-3.2.1-py3-none-any.whl

CVE-2022-36087 - Medium Severity Vulnerability

Vulnerable Library - oauthlib-3.2.1-py3-none-any.whl

A generic, spec-compliant, thorough implementation of the OAuth request-signing logic

Library home page: https://files.pythonhosted.org/packages/92/bb/d669baf53d4ffe081dab80aad93c5c79f84eeac885dd31507c8c055a98d5/oauthlib-3.2.1-py3-none-any.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm,/tools/requirements.txt

Dependency Hierarchy:

  • oauthlib-3.2.1-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of uri_validate functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly uri_validate are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.
Mend Note: After conducting further research, Mend has determined that versions 3.1.1 through 3.2.1 of oauthlib are vulnerable to CVE-2022-36087.

Publish Date: 2022-09-09

URL: CVE-2022-36087

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3pgj-pg6c-r5p7

Release Date: 2022-09-09

Fix Resolution: oauthlib - 3.2.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-45199 (High) detected in Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

CVE-2022-45199 - High Severity Vulnerability

Vulnerable Library - Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/86/d2/ca178ad71dcd1dcddbe2a3f7983639d2f8a20e723d9a978ab978ed08c874/Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Path to dependency file: /tools/requirements.txt

Path to vulnerable library: /tools/requirements.txt,/requirements.txt,/libs/csm/csm,/switch

Dependency Hierarchy:

  • Pillow-9.2.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Publish Date: 2022-11-14

URL: CVE-2022-45199

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-11-14

Fix Resolution: 9.3.0


⛑️ Automatic Remediation will be attempted for this issue.

WS-2022-0365 (Critical) detected in cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl, cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

WS-2022-0365 - Critical Severity Vulnerability

Vulnerable Libraries - cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl, cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/fb/12/ed7aed6d59dbb3886fd14d3423ec9730f6a68e9d1271160732b1d9738046/cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)
cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/9b/4e/d7454551c3c7b327510e35d88db35c300484225ba47be861e28f0b520b33/cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Path to dependency file: /libs/csm/csm

Path to vulnerable library: /libs/csm/csm,/tools/requirements.txt,/switch

Dependency Hierarchy:

  • cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-38.0.3 are vulnerable to a number of security issues. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

Publish Date: 2022-11-02

URL: WS-2022-0365

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-39hc-v87j-747x

Release Date: 2022-11-02

Fix Resolution: 38.0.3


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-33503 (High) detected in urllib3-1.25.3-py2.py3-none-any.whl - autoclosed

CVE-2021-33503 - High Severity Vulnerability

Vulnerable Library - urllib3-1.25.3-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/e6/60/247f23a7121ae632d62811ba7f273d0e58972d75e58a94d329d51550a47d/urllib3-1.25.3-py2.py3-none-any.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • urllib3-1.25.3-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: ef77fa6ea195cb251a124be382b5c33f280e7db1

Found in base branch: main

Vulnerability Details

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Publish Date: 2021-06-29

URL: CVE-2021-33503

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q2q7-5pp4-w6pg

Release Date: 2021-06-29

Fix Resolution: urllib3 - 1.26.5


⛑️ Automatic Remediation is available for this issue

CVE-2021-34141 (Medium) detected in numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

CVE-2021-34141 - Medium Severity Vulnerability

Vulnerable Library - numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/50/46/292cff79f5b30151b027400efdb3f740ea03271b600751b6696cf550c10d/numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/requirements.txt,/libs/csm/csm

Dependency Hierarchy:

  • numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Mend Note: After conducting further research, Mend has determined that versions 1.12.0 through 1.21.6 of numpy are vulnerable to CVE-2021-34141

Publish Date: 2021-12-17

URL: CVE-2021-34141

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34141

Release Date: 2021-12-17

Fix Resolution: 1.22.0


⛑️ Automatic Remediation will be attempted for this issue.

Remove s3bench logs location from the project root

Problem

S3bench logs are bloating in cortx-test root folder precisely in the CWD instead of log folder. Collect s3bench logs into test log folder itself.

Expected behavior

Collect s3bench logs into test log folder itself.

How to reproduce

Run sanity test cases.

Deployment information

Single test client i.e Corbot on CentOS 7+

Additional information

No response

Fix/Revert s3_test_lib Changes (Do not use/mix cli with s3 boto api ), Ref:https://github.com/Seagate/cortx-test/pull/563

https://github.com/Seagate/cortx-test/pull/563/files#diff-99d72be4c53317d66f97337cbde5d09822f03b086836807927efe4f1fe0727fb

Remove following imports :
from libs.csm.cli.cortx_cli_s3_buckets import CortxCliS3BucketOperations
from libs.csm.cli.cortx_cli_s3_accounts import CortxCliS3AccountOperations
and associated Object
self.s3bkt_obj = CortxCliS3BucketOperations()

and use only
libs/s3/cortxcli_test_lib.py for cli related operations (may add required imports/calls method here)

CVE-2023-23931 (Medium) detected in cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl, cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

CVE-2023-23931 - Medium Severity Vulnerability

Vulnerable Libraries - cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl, cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/fb/12/ed7aed6d59dbb3886fd14d3423ec9730f6a68e9d1271160732b1d9738046/cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)
cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/9b/4e/d7454551c3c7b327510e35d88db35c300484225ba47be861e28f0b520b33/cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Path to dependency file: /libs/csm/csm

Path to vulnerable library: /libs/csm/csm,/tools/requirements.txt,/switch

Dependency Hierarchy:

  • cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as bytes) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since update_into was originally introduced in cryptography 1.8.

Publish Date: 2023-02-07

URL: CVE-2023-23931

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-23931

Release Date: 2023-02-07

Fix Resolution: 39.0.1


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-20477 (High) detected in PyYAML-5.1.2.tar.gz - autoclosed

CVE-2019-20477 - High Severity Vulnerability

Vulnerable Library - PyYAML-5.1.2.tar.gz

YAML parser and emitter for Python

Library home page: https://files.pythonhosted.org/packages/e3/e8/b3212641ee2718d556df0f23f78de8303f068fe29cdaa7a91018849582fe/PyYAML-5.1.2.tar.gz

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm

Dependency Hierarchy:

  • PyYAML-5.1.2.tar.gz (Vulnerable Library)

Found in HEAD commit: ef77fa6ea195cb251a124be382b5c33f280e7db1

Found in base branch: main

Vulnerability Details

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Publish Date: 2020-02-19

URL: CVE-2019-20477

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20477

Release Date: 2020-03-01

Fix Resolution: 5.2


⛑️ Automatic Remediation is available for this issue

create_file function does not throw error if disk is full and unable to create requested file

Need to add error handling in create_file function in commons/utils/system_utils.py file.

def create_file(
        fpath: str,
        count: int,
        dev: str = "/dev/zero",
        b_size: str = "1M") -> tuple:
    """
    Create file using dd command.
    :param fpath: File path.
    :param count: size of the file in MB.
    :param dev: Input file used.
    :param b_size: block size.
    :return:
    """
    cmd = commands.CREATE_FILE.format(dev, fpath, b_size, count)
    LOGGER.debug(cmd)
    result = run_local_cmd(cmd, flg=True)
    LOGGER.debug("output = %s", str(result))
    result = (os.path.exists(fpath), result[1])

    return result

Please make this repo public

As soon as possible, please make this repo public. Please leave this Issue open until we make it public.

 

Tracking Page:

[Open Sourcing Cortx-Test and CORIO - Private-Cortx - Confluence (atlassian.net)|https://seagate-systems.atlassian.net/wiki/spaces/PRIVATECOR/pages/898039873/Open+Sourcing+Cortx-Test+and+CORIO]

 

CVE-2020-1747 (High) detected in PyYAML-5.1.2.tar.gz - autoclosed

CVE-2020-1747 - High Severity Vulnerability

Vulnerable Library - PyYAML-5.1.2.tar.gz

YAML parser and emitter for Python

Library home page: https://files.pythonhosted.org/packages/e3/e8/b3212641ee2718d556df0f23f78de8303f068fe29cdaa7a91018849582fe/PyYAML-5.1.2.tar.gz

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm

Dependency Hierarchy:

  • PyYAML-5.1.2.tar.gz (Vulnerable Library)

Found in HEAD commit: ef77fa6ea195cb251a124be382b5c33f280e7db1

Found in base branch: main

Vulnerability Details

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Publish Date: 2020-03-24

URL: CVE-2020-1747

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6757-jp84-gxfx

Release Date: 2020-03-24

Fix Resolution: pyyaml - 5.3.1


⛑️ Automatic Remediation is available for this issue

Reduce the number of pytest marker for deployment tests

Problem

Test Environment field from Jira TE is used to mention the deployment tags used to group the test cases. We don't want these tags to propagate in code as tests are writing for N+ (N = 3 nodes) cluster deployment.

What we want is to have cluster_deployment as the test env tag. If the nodes in a cluster is 3 or 4 or N , it can be put in Jira labels. The setup entry or the Common config is aware of the number of nodes (CMN_CFG["nodes"]) in the cluster and test should be using that value in the test or lib code.

Currently used tags are mention in the list below.
three_node_deployment
four_node_deployment
five_node_deployment
six_node_deployment
seven_node_deployment
eight_node_deployment
nine_node_deployment
ten_node_deployment
eleven_node_deployment
twelve_node_deployment
thirteen_node_deployment
fourteen_node_deployment
fifteen_node_deployment

A better solution needs to be identified and developed to reduce the number of invalid tags in code base.

Expected behavior

A better solution needs to be identified and developed to reduce the number of invalid tags in code base. "cluster_deployment" tag should be used as the test env tag.

How to reproduce

Refer pytest.ini file for three_node_deployment, four_node_deployment, etc tags. This is a design issue.

Deployment information

NA

Additional information

No response

CVE-2023-23934 (Low) detected in Werkzeug-2.2.2-py3-none-any.whl, Werkzeug-1.0.1-py2.py3-none-any.whl

CVE-2023-23934 - Low Severity Vulnerability

Vulnerable Libraries - Werkzeug-2.2.2-py3-none-any.whl, Werkzeug-1.0.1-py2.py3-none-any.whl

Werkzeug-2.2.2-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c8/27/be6ddbcf60115305205de79c29004a0c6bc53cec814f733467b1bb89386d/Werkzeug-2.2.2-py3-none-any.whl

Path to dependency file: /tools/requirements.txt

Path to vulnerable library: /tools/requirements.txt,/switch,/libs/csm/csm

Dependency Hierarchy:

  • Werkzeug-2.2.2-py3-none-any.whl (Vulnerable Library)
Werkzeug-1.0.1-py2.py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/cc/94/5f7079a0e00bd6863ef8f1da638721e9da21e5bacee597595b318f71d62e/Werkzeug-1.0.1-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/libs/csm/csm,/requirements.txt,/switch

Dependency Hierarchy:

  • Werkzeug-1.0.1-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =__Host-test=bad for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie =__Host-test=bad as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.

Publish Date: 2023-02-14

URL: CVE-2023-23934

CVSS 3 Score Details (3.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-23934

Release Date: 2023-02-14

Fix Resolution: Werkzeug - 2.2.3


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-30861 (High) detected in Flask-1.1.2-py2.py3-none-any.whl, Flask-2.2.2-py3-none-any.whl

CVE-2023-30861 - High Severity Vulnerability

Vulnerable Libraries - Flask-1.1.2-py2.py3-none-any.whl, Flask-2.2.2-py3-none-any.whl

Flask-1.1.2-py2.py3-none-any.whl

A simple framework for building complex web applications.

Library home page: https://files.pythonhosted.org/packages/f2/28/2a03252dfb9ebf377f40fba6a7841b47083260bf8bd8e737b0c6952df83f/Flask-1.1.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/switch,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • Flask-1.1.2-py2.py3-none-any.whl (Vulnerable Library)
Flask-2.2.2-py3-none-any.whl

A simple framework for building complex web applications.

Library home page: https://files.pythonhosted.org/packages/0f/43/15f4f9ab225b0b25352412e8daa3d0e3d135fcf5e127070c74c3632c8b4c/Flask-2.2.2-py3-none-any.whl

Path to dependency file: /tools/requirements.txt

Path to vulnerable library: /tools/requirements.txt,/switch,/tools/requirements.txt,/libs/csm/csm

Dependency Hierarchy:

  • Flask-2.2.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Publish Date: 2023-05-02

URL: CVE-2023-30861

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-30861

Release Date: 2023-05-02

Fix Resolution: flask - 2.2.5,2.3.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-33430 (High) detected in numpy-1.19.5-cp37-cp37m-manylinux2010_x86_64.whl - autoclosed

CVE-2021-33430 - High Severity Vulnerability

Vulnerable Library - numpy-1.19.5-cp37-cp37m-manylinux2010_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/08/d6/a6aaa29fea945bc6c61d11f6e0697b325ff7446de5ffd62c2fa02f627048/numpy-1.19.5-cp37-cp37m-manylinux2010_x86_64.whl

Path to dependency file: /tools/dash_server/requirements.txt

Path to vulnerable library: /tools/dash_server/requirements.txt,/switch,/libs/csm/csm,/tools/dash_server/requirements.txt

Dependency Hierarchy:

  • numpy-1.19.5-cp37-cp37m-manylinux2010_x86_64.whl (Vulnerable Library)

Found in HEAD commit: ef77fa6ea195cb251a124be382b5c33f280e7db1

Found in base branch: main

Vulnerability Details

** DISPUTED ** A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.

Publish Date: 2021-12-17

URL: CVE-2021-33430

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-33430

Release Date: 2021-12-17

Fix Resolution: numpy - 1.21.0


⛑️ Automatic Remediation is available for this issue

CVE-2023-25577 (High) detected in Werkzeug-2.2.2-py3-none-any.whl, Werkzeug-1.0.1-py2.py3-none-any.whl

CVE-2023-25577 - High Severity Vulnerability

Vulnerable Libraries - Werkzeug-2.2.2-py3-none-any.whl, Werkzeug-1.0.1-py2.py3-none-any.whl

Werkzeug-2.2.2-py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/c8/27/be6ddbcf60115305205de79c29004a0c6bc53cec814f733467b1bb89386d/Werkzeug-2.2.2-py3-none-any.whl

Path to dependency file: /tools/requirements.txt

Path to vulnerable library: /tools/requirements.txt,/switch,/libs/csm/csm

Dependency Hierarchy:

  • Werkzeug-2.2.2-py3-none-any.whl (Vulnerable Library)
Werkzeug-1.0.1-py2.py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/cc/94/5f7079a0e00bd6863ef8f1da638721e9da21e5bacee597595b318f71d62e/Werkzeug-1.0.1-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/libs/csm/csm,/requirements.txt,/switch

Dependency Hierarchy:

  • Werkzeug-1.0.1-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses request.data, request.form, request.files, or request.get_data(parse_form_data=False), it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.

Publish Date: 2023-02-14

URL: CVE-2023-25577

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-25577

Release Date: 2023-02-14

Fix Resolution: Werkzeug - 2.2.3


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-26137 (Medium) detected in urllib3-1.25.3-py2.py3-none-any.whl - autoclosed

CVE-2020-26137 - Medium Severity Vulnerability

Vulnerable Library - urllib3-1.25.3-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/e6/60/247f23a7121ae632d62811ba7f273d0e58972d75e58a94d329d51550a47d/urllib3-1.25.3-py2.py3-none-any.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • urllib3-1.25.3-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: ef77fa6ea195cb251a124be382b5c33f280e7db1

Found in base branch: main

Vulnerability Details

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Publish Date: 2020-09-30

URL: CVE-2020-26137

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26137

Release Date: 2020-09-30

Fix Resolution: 1.25.9


⛑️ Automatic Remediation is available for this issue

CVE-2022-23491 (High) detected in certifi-2019.6.16-py2.py3-none-any.whl, certifi-2022.9.14-py3-none-any.whl

CVE-2022-23491 - High Severity Vulnerability

Vulnerable Libraries - certifi-2019.6.16-py2.py3-none-any.whl, certifi-2022.9.14-py3-none-any.whl

certifi-2019.6.16-py2.py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/69/1b/b853c7a9d4f6a6d00749e94eb6f3a041e342a885b87340b79c1ef73e3a78/certifi-2019.6.16-py2.py3-none-any.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/requirements.txt,/libs/csm/csm

Dependency Hierarchy:

  • certifi-2019.6.16-py2.py3-none-any.whl (Vulnerable Library)
certifi-2022.9.14-py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/6a/34/cd29f4dd8a23ce45f2b8ce9631ff2d4205fb74eddb412a3dc4fd1e4aa800/certifi-2022.9.14-py3-none-any.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/libs/csm/csm,/tools/requirements.txt

Dependency Hierarchy:

  • certifi-2022.9.14-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

Publish Date: 2022-12-07

URL: CVE-2022-23491

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23491

Release Date: 2022-12-07

Fix Resolution: 2022.12.7


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24302 (Medium) detected in paramiko-2.6.0-py2.py3-none-any.whl - autoclosed

CVE-2022-24302 - Medium Severity Vulnerability

Vulnerable Library - paramiko-2.6.0-py2.py3-none-any.whl

SSH2 protocol library

Library home page: https://files.pythonhosted.org/packages/4b/80/74dace9e48b0ef923633dfb5e48798f58a168e4734bca8ecfaf839ba051a/paramiko-2.6.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/libs/csm/csm,/switch,/requirements.txt

Dependency Hierarchy:

  • paramiko-2.6.0-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.

Publish Date: 2022-03-17

URL: CVE-2022-24302

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.paramiko.org/changelog.html

Release Date: 2022-03-17

Fix Resolution: paramiko - 2.10.1


⛑️ Automatic Remediation is available for this issue

Refine Telnet_helper for exception handling.

Why are we using generic exception to handle error/exceptions . Figure out what exception you want to handle e.g. socket exception and then do handling .
Also, are you connecting telnet in this function and why it is named as connect ? Alternatively you may pull connection code and make it as a behavior.

Originally posted by @seagate-sarang-sawant in #16 (comment)

CVE-2020-7212 (High) detected in urllib3-1.25.3-py2.py3-none-any.whl - autoclosed

CVE-2020-7212 - High Severity Vulnerability

Vulnerable Library - urllib3-1.25.3-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/e6/60/247f23a7121ae632d62811ba7f273d0e58972d75e58a94d329d51550a47d/urllib3-1.25.3-py2.py3-none-any.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • urllib3-1.25.3-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: ef77fa6ea195cb251a124be382b5c33f280e7db1

Found in base branch: main

Vulnerability Details

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

Publish Date: 2020-03-06

URL: CVE-2020-7212

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hmv2-79q8-fv6g

Release Date: 2020-03-09

Fix Resolution: urllib3 - 1.25.8


⛑️ Automatic Remediation is available for this issue

CVE-2021-41496 (Medium) detected in numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl - autoclosed

CVE-2021-41496 - Medium Severity Vulnerability

Vulnerable Library - numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/50/46/292cff79f5b30151b027400efdb3f740ea03271b600751b6696cf550c10d/numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/requirements.txt,/libs/csm/csm

Dependency Hierarchy:

  • numpy-1.21.5-cp37-cp37m-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

** DISPUTED ** Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally).
Mend Note: After conducting further research, Mend has determined that numpy versions before 1.22.0 are vulnerable to CVE-2021-41496

Publish Date: 2021-12-17

URL: CVE-2021-41496

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41496

Release Date: 2021-12-17

Fix Resolution: numpy - 1.22.3


⛑️ Automatic Remediation is available for this issue

CVE-2022-42969 (High) detected in py-1.11.0-py2.py3-none-any.whl

CVE-2022-42969 - High Severity Vulnerability

Vulnerable Library - py-1.11.0-py2.py3-none-any.whl

library with cross-python path, ini-parsing, io, code, log facilities

Library home page: https://files.pythonhosted.org/packages/f6/f0/10642828a8dfb741e5f3fbaac830550a518a775c7fff6f04a007259b0548/py-1.11.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/libs/csm/csm,/switch

Dependency Hierarchy:

  • py-1.11.0-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.

Publish Date: 2022-10-16

URL: CVE-2022-42969

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2023-0286 (High) detected in cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl, cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

CVE-2023-0286 - High Severity Vulnerability

Vulnerable Libraries - cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl, cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/fb/12/ed7aed6d59dbb3886fd14d3423ec9730f6a68e9d1271160732b1d9738046/cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • cryptography-37.0.0-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)
cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/9b/4e/d7454551c3c7b327510e35d88db35c300484225ba47be861e28f0b520b33/cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Path to dependency file: /libs/csm/csm

Path to vulnerable library: /libs/csm/csm,/tools/requirements.txt,/switch

Dependency Hierarchy:

  • cryptography-38.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Publish Date: 2023-02-08

URL: CVE-2023-0286

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x4qr-2fvf-3mr5

Release Date: 2023-02-08

Fix Resolution: OpenSSL_1_0_2a--OpenSSL_1_0_2u;OpenSSL_1_1_1a--OpenSSL_1_1_1s;cryptography - 39.0.1


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24439 (Critical) detected in GitPython-3.1.27-py3-none-any.whl

CVE-2022-24439 - Critical Severity Vulnerability

Vulnerable Library - GitPython-3.1.27-py3-none-any.whl

GitPython is a python library used to interact with Git repositories

Library home page: https://files.pythonhosted.org/packages/83/32/ce68915670da6fd6b1e3fb4b3554b4462512f6441dddd194fc0f4f6ec653/GitPython-3.1.27-py3-none-any.whl

Path to dependency file: /switch

Path to vulnerable library: /switch,/libs/csm/csm,/requirements.txt

Dependency Hierarchy:

  • GitPython-3.1.27-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Publish Date: 2022-12-06

URL: CVE-2022-24439

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2022-29361 (High) detected in Werkzeug-1.0.1-py2.py3-none-any.whl - autoclosed

CVE-2022-29361 - High Severity Vulnerability

Vulnerable Library - Werkzeug-1.0.1-py2.py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/cc/94/5f7079a0e00bd6863ef8f1da638721e9da21e5bacee597595b318f71d62e/Werkzeug-1.0.1-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/libs/csm/csm,/requirements.txt,/switch

Dependency Hierarchy:

  • Werkzeug-1.0.1-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 2a86195797b4352c780fa88a5a2cf3dfea63af99

Found in base branch: main

Vulnerability Details

** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project.

Publish Date: 2022-05-25

URL: CVE-2022-29361

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29361

Release Date: 2022-05-25

Fix Resolution: Werkzeug - 2.1.1


⛑️ Automatic Remediation is available for this issue

CVE-2020-14343 (High) detected in PyYAML-5.1.2.tar.gz - autoclosed

CVE-2020-14343 - High Severity Vulnerability

Vulnerable Library - PyYAML-5.1.2.tar.gz

YAML parser and emitter for Python

Library home page: https://files.pythonhosted.org/packages/e3/e8/b3212641ee2718d556df0f23f78de8303f068fe29cdaa7a91018849582fe/PyYAML-5.1.2.tar.gz

Path to dependency file: /switch

Path to vulnerable library: /switch,/requirements.txt,/libs/csm/csm

Dependency Hierarchy:

  • PyYAML-5.1.2.tar.gz (Vulnerable Library)

Found in HEAD commit: ef77fa6ea195cb251a124be382b5c33f280e7db1

Found in base branch: main

Vulnerability Details

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Publish Date: 2021-02-09

URL: CVE-2020-14343

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14343

Release Date: 2021-02-09

Fix Resolution: PyYAML - 5.4


⛑️ Automatic Remediation is available for this issue

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.