search

stanford-centaur / smt-switch

A generic C++ API for SMT solving. It provides abstract classes which can be implemented by different SMT solvers.
Other
114 stars 43 forks source link

Potential secutiry vulnerability in the shared library which smt-switch depends on. Can you help upgrade to patch versions? #299

Open andy201709 opened 2 years ago

andy201709 commented 2 years ago

Hi, @makaimann , @yoni206 , I'd like to report a vulnerability issue in smt-switch_0.3.0.

Dependency Graph between Python and Shared Libraries

image

Issue Description

As shown in the above dependency graph, smt-switch_0.3.0 directly or transitively depends on 6 C libraries (.so). However, I noticed that some C libraries are vulnerable, containing the following CVEs: libgmp-afec2dd4.so.10.2.0 and libgmpxx-25f6cf8d.so.4.4.0from C project gmp(version:6.1.0) exposed 1 vulnerabilities: CVE-2021-43618

Suggested Vulnerability Patch Versions

No official patch version released, but gmp has fixed the vulnerability in patch.

Python build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Python projects. As a popular python package (smt-switch has 790 downloads per month), could you please upgrade the above shared libraries to their patch versions?

Thanks for your help~ Best regards, Andy

yoni206 commented 2 years ago

Thanks @andy201709 for this.

@makaimann -- how come we directly depend on gmp and not only transitively? That is, I am surprised by the arrow from smt-switch.cpython... to libgmpxxx on the right.

Further -- how can we upgrade gmp for the solvers that we use? Won't that depend on an upgrade done by the solvers themselves?

makaimann commented 2 years ago

Thanks for reporting this @andy201709!

@yoni206, this is for the generated smt_switch Python wheels, where the libraries are bundled with it.

I don't think we need an upgrade from the solvers (assuming the interface still matches), but I'm not certain. I'll try to look into this when I get a chance. Basically, when creating the wheels through the manylinux Docker image, we would need to upgrade the gmp version there.

andy201709 commented 2 years ago

I understand it, thanks @makaimann .