search

pyupio / dparse

A parser for Python dependency files
MIT License
61 stars 23 forks source link

GHSL-2021-111 #50

Closed kevinbackhouse closed 2 years ago

kevinbackhouse commented 3 years ago

Hello,

The GitHub Security Lab team has found a potential vulnerability in your project. Please create a Security Advisory and invite me in to further disclose and discuss the vulnerability details and potential fix. Alternatively, please add a Security Policy containing a security email address to send the details to.

If you prefer to contact us by email, please reach out to securitylab@github.com with reference to GHSL-2021-111.

Thank you,
Kevin Backhouse GitHub Security Lab

ptmcg commented 2 years ago

Is there any activity on this issue? dparse is used in flask-restx, which is currently failing ossaudit security check due to this project. (See https://github.com/python-restx/flask-restx/pull/463.)

kevinbackhouse commented 2 years ago

This is a ReDoS issue, so it's low severity. It was fixed in the nexB fork but not here. I didn't publish our advisory because the issue hadn't been fully resolved, but it's been almost a year now so I'll publish it. It should appear here in the next few days.

yeisonvargasf commented 2 years ago

@ptmcg this will be fixed in the next few days. Thanks @kevinbackhouse for the patience here, I'll address that before the advisory is published.

yeisonvargasf commented 2 years ago

@kevinbackhouse I've created the draft security advisory, and I invited you.

yeisonvargasf commented 2 years ago

I am closing this, thanks @kevinbackhouse!