search

PyCQA / bandit

Bandit is a tool designed to find common security issues in Python code.
https://bandit.readthedocs.io
Apache License 2.0
6.52k stars 612 forks source link

security: cve-2024-22910 #1097

Closed misogihagi closed 10 months ago

misogihagi commented 10 months ago

https://github.com/advisories/GHSA-2mqj-m65w-jghx

lukehinds commented 10 months ago

@ericwb / @sigmavirus24 worth us getting a release out to turn off the noisey cve scanners, but I don't believe we are impacted. The exploit seems to only work when USE_SHELL or Shell=True is use (we do in fact warn against it).

sigmavirus24 commented 10 months ago

@ericwb / @sigmavirus24 worth us getting a release out to turn off the noisey cve scanners, but I don't believe we are impacted. The exploit seems to only work when USE_SHELL or Shell=True is use (we do in fact warn against it).

It really doesn't feel worth it. Greater equal means reinstalling will get you the new version unless you otherwise have it constrained. And if you have it constrained you have the power to shut up those scanners that suck so very much

lukehinds commented 10 months ago

@ericwb / @sigmavirus24 worth us getting a release out to turn off the noisey cve scanners, but I don't believe we are impacted. The exploit seems to only work when USE_SHELL or Shell=True is use (we do in fact warn against it).

It really doesn't feel worth it. Greater equal means reinstalling will get you the new version unless you otherwise have it constrained. And if you have it constrained you have the power to shut up those scanners that suck so very much

I am inclined to agree. Let's roll it up in the next release.

I will close, but thanks for raising @misogihagi

lukehinds commented 10 months ago

Reopen (it was a PR, not an issue)

ericwb commented 10 months ago

We also don't support or test running Bandit on Windows, so this CVE doesn't apply.

sigmavirus24 commented 10 months ago

Fixing this by making gitpython an extra