Error with urllib3_with_brotli

[Dystopie-github]

Hello,

I installed the latest version of pymisp until I realize I needed an old version because I'm using Python 3.9. I reinstalled pymisp version: pip3 install --upgrade pymisp==2.4.169 I tried multiple version of pymisp without success.

I have a function that try to initialize MISP and it fail with an python error. Here the code

def GetMispAttributes(misp_url, misp_key, misp_verifycert):
        # authenticate to misp
        misp = PyMISP(misp_url, misp_key, misp_verifycert)
        ...

Here is the stacktrace:

File "cf_misp_to_crowdstrike", line 231, in cfentry File "lib3/phantom/decided/playbook_resource_score.py/playbook_resource_score.py", line 123, in _wrapper File "cf_misp_to_crowdstrike", line 193, in cf_misp_to_crowdstrike File "cf_misp_to_crowdstrike", line 33, in GetMispAttributes File "/opt/phantom/usr/python39/lib/python3.9/site-packages/pymisp/api.py", line 189, in __init__ try: File "/opt/phantom/usr/python39/lib/python3.9/site-packages/pymisp/api.py", line 129, in brotli_supported urllib3_with_brotli = (major == 1 and ((minor == 25 and patch >= 1) or (minor >= 26))) or major >= 2 AttributeError: 'NoneType' object has no attribute 'split' I think I need a correct matching version between requests, brotli and pymisp but I don't know which version to use. Thank you,

[Rafiot]

Try with the very latest version of PyMISP, it is still compatible with python 3.9.

[Dystopie-github]

WIth the latest version v2.4.188 or v2.4.190, I have a similar but different error:

Traceback (most recent call last): File "cf_misp_to_crowdstrike", line 231, in cfentry File "lib3/phantom/decided/playbook_resource_score.py/playbook_resource_score.py", line 123, in _wrapper File "cf_misp_to_crowdstrike", line 193, in cf_misp_to_crowdstrike File "cf_misp_to_crowdstrike", line 33, in GetMispAttributes File "/opt/phantom/usr/python39/lib/python3.9/site-packages/pymisp/api.py", line 189, in __init__ if brotli_supported(): File "/opt/phantom/usr/python39/lib/python3.9/site-packages/pymisp/api.py", line 129, in brotli_supported version_splitted = version('urllib3').split('.') # noqa: F811 AttributeError: 'NoneType' object has no attribute 'split'

[Rafiot]

ok, so version('urllib3') returns None on your machine. It makes very little sense as urllib3 is a dependency of PyMISP and it is pulled on install.

I'm wondering if you're running the script as a different user from the one you installed PyMISP with? Or in a different environment?

[Dystopie-github]

OK, it really strange because If I modify my code to add

print(urllib.request.__version__)

It does print version 3.9

[Rafiot]

from the same terminal you installed PyMISP (without sudo), run in a python terminal:

from importlib.metadata import version
print(version('pymisp'))
print(version('urllib3'))

[Rafiot]

Also, this is incorrect, you're checking the version of urllib not urllib3

[Dystopie-github]

OK, it does return NONE.

print(version('pymisp')) 2.4.188 print(version('urllib3')) None

Looking at the logs for pymisp installation. I do see

Requirement already satisfied: urllib3<3,>=1.21.1 in ./usr/python39/lib/python3.9/site-packages (from requests<3.0.0,>=2.31.0->pymisp==2.4.188) (2.2.1)

[Rafiot]

Both of them return None? Somehow, they're not installed in the virtual environment you're in. My guess it that it has something to do with an installation done as root (sudo), or something permission related.

[Dystopie-github]

I checked the permission. I can't find anything wrong. I'm using python on an application call. Splunk soar. I opened a ticket with them because urllib3 return none on all my server running that application.

[Rafiot]

yeah, they can probably give you some hints, because you cannot have PyMISP installed without urllib3 normally.