Outdated Python Package with Vulnerability

mitre-attack / attack-stix-data

STIX data representing MITRE ATT&CK

https://attack.mitre.org/

Other

348 stars 87 forks source link

Outdated Python Package with Vulnerability #49

Closed girlpunk closed 4 months ago

girlpunk commented 4 months ago

The requirements.txt in the util folder shows TQDM version 4.61.1 as a dependency, however this version of the library contains an arbitrary code execution vulnerability, https://security.snyk.io/vuln/SNYK-PYTHON-TQDM-6807582

Please could this package be updated or, if the scripts are no longer supported (as they haven't been changed in a year, or had updates in 3 years), it may be worth removing the scripts from the repo.

jondricek commented 4 months ago

Thank you for pointing this out! I just updated the requirements.txt file addressing this. While the scripts in that folder haven't changed much over the years, we will likely keep them around and might be adding some more scripts we use there in the future.