Bug #2048424 “Multiple CVE's reported for stock Python” : Bugs : python-pip package : Ubuntu

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2024-01-06:

#1

Thanks for reporting this issue.

The safety tool is relying on versions of python modules to determine if something is vulnerable or not. Ubuntu, like most linux distros, backports security updates to existing versions.

Please look up each CVE reported by the safety tool using our web interface here and report back any that are not a false positive: https://ubuntu.com/security/cves

Thanks!

Changed in python (Ubuntu):
status:	New → Incomplete

Revision history for this message

mcandre (andrew-pennebaker) wrote on 2024-01-06: Re: [Bug 2048424] Re: Multiple CVE's reported for stock Python

#2

Download full text (6.8 KiB)

Using the primary ubuntu [jammy] image on Docker as an example base.

Trace:

# apt-get update
# apt-get install -y python3-pip
# pip install safety
# safety check
+========================================================================+

                               /$$$$$$ /$$
                              /$$__ $$ | $$
           /$$$$$$$ /$$$$$$ | $$ \__//$$$$$$ /$$$$$$ /$$ /$$
          /$$_____/ |____ $$| $$$$ /$$__ $$|_ $$_/ | $$ | $$
         | $$$$$$ /$$$$$$$| $$_/ | $$$$$$$$ | $$ | $$ | $$
          \____ $$ /$$__ $$| $$ | $$_____/ | $$ /$$| $$ | $$
          /$$$$$$$/| $$$$$$$| $$ | $$$$$$$ | $$$$/| $$$$$$$
         |_______/ \_______/|__/ \_______/ \___/ \____ $$
                                                          /$$ | $$
                                                         | $$$$$$/
  by pyup.io \______/

+========================================================================+

REPORT

Safety is using PyUp's free open-source vulnerability
database. This data is 30 days old and limited.
For real-time enhanced vulnerability data, fix recommendations,
severity reporting, cybersecurity support, team and project policy
management and more sign up at https://pyup.io or email <email address hidden>

Safety v2.3.5 is scanning for Vulnerabilities...
Scanning dependencies in your environment:

-> /usr/lib/python3/dist-packages
-> /usr/local/lib/python3.10/dist-packages

  Using non-commercial database
  Found and scanned 16 packages
  Timestamp 2024-01-06 19:47:32
  3 vulnerabilities found
  0 vulnerabilities ignored

+========================================================================+
VULNERABILITIES FOUND
+========================================================================+

-> Vulnerability found in setuptools version 59.6.0
   Vulnerability ID: 52495
   Affected spec: <65.5.1
   ADVISORY: Setuptools 65.5.1 includes a fix for CVE-2022-40897:
   Python Packaging Authority (PyPA) setuptools before 65.5.1 allows...
   CVE-2022-40897
   For more information, please visit
   https://data.safetycli.com/v/52495/f17

-> Vulnerability found in pip version 22.0.2
   Vulnerability ID: 62044
   Affected spec: <23.3
   ADVISORY: Pip 23.3 includes a fix for CVE-2023-5752: When
   installing a package from a Mercurial VCS URL (ie "pip install...
   CVE-2023-5752
   For more information, please visit
   https://data.safetycli.com/v/62044/f17

-> Vulnerability found in wheel version 0.37.1
   Vulnerability ID: 51499
   Affected spec: <0.38.1
   ADVISORY: Wheel 0.38.1 includes a fix for CVE-2022-40898: An
   issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1...
   CVE-2022-40898
   For more information, please visit
   https://data.safetycli.com/v/51499/f17

Scan was completed. 3 vulnerabilities were found.

+========================================================================+
REMEDIATIONS

3 vulnerabilities were found in 3 packages. For detailed remediation &
fix recommendations, upgrade to a commercial license.

+================================================================...

Using the primary ubuntu [jammy] image on Docker as an example base.

Trace:

# apt-get update
# apt-get install -y python3-pip
# pip install safety
# safety check
+========================================================================+

/$$$$$$            /$$
                              /$$__  $$          | $$
           /$$$$$$$  /$$$$$$ | $$  \__//$$$$$$  /$$$$$$   /$$   /$$
          /$$_____/ |____  $$| $$$$   /$$__  $$|_  $$_/  | $$  | $$
         |  $$$$$$   /$$$$$$$| $$_/  | $$$$$$$$  | $$    | $$  | $$
          \____  $$ /$$__  $$| $$    | $$_____/  | $$ /$$| $$  | $$
          /$$$$$$$/|  $$$$$$$| $$    |  $$$$$$$  |  $$$$/|  $$$$$$$
         |_______/  \_______/|__/     \_______/   \___/   \____  $$
                                                          /$$  | $$
                                                         |  $$$$$$/
  by pyup.io                                              \______/

+========================================================================+

REPORT

Safety is using PyUp's free open-source vulnerability
database. This data is 30 days old and limited.
  For real-time enhanced vulnerability data, fix recommendations,
severity reporting, cybersecurity support, team and project policy
management and more sign up at https://pyup.io or email sales@pyup.io

Safety v2.3.5 is scanning for Vulnerabilities...
  Scanning dependencies in your environment:

-> /usr/lib/python3/dist-packages
  -> /usr/local/lib/python3.10/dist-packages

Using non-commercial database
  Found and scanned 16 packages
  Timestamp 2024-01-06 19:47:32
  3 vulnerabilities found
  0 vulnerabilities ignored

+========================================================================+
 VULNERABILITIES FOUND
+========================================================================+

-> Vulnerability found in setuptools version 59.6.0
   Vulnerability ID: 52495
   Affected spec: <65.5.1
   ADVISORY: Setuptools 65.5.1 includes a fix for CVE-2022-40897:
   Python Packaging Authority (PyPA) setuptools before 65.5.1 allows...
   CVE-2022-40897
   For more information, please visit
   https://data.safetycli.com/v/52495/f17

-> Vulnerability found in pip version 22.0.2
   Vulnerability ID: 62044
   Affected spec: <23.3
   ADVISORY: Pip 23.3 includes a fix for CVE-2023-5752: When
   installing a package from a Mercurial VCS URL (ie "pip install...
   CVE-2023-5752
   For more information, please visit
   https://data.safetycli.com/v/62044/f17

-> Vulnerability found in wheel version 0.37.1
   Vulnerability ID: 51499
   Affected spec: <0.38.1
   ADVISORY: Wheel 0.38.1 includes a fix for CVE-2022-40898: An
   issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1...
   CVE-2022-40898
   For more information, please visit
   https://data.safetycli.com/v/51499/f17

Scan was completed. 3 vulnerabilities were found.

+========================================================================+
   REMEDIATIONS

3 vulnerabilities were found in 3 packages. For detailed remediation &
  fix recommendations, upgrade to a commercial license.

+========================================================================+

Safety is using PyUp's free open-source vulnerability
database. This data is 30 days old and limited.
  For real-time enhanced vulnerability data, fix recommendations,
severity reporting, cybersecurity support, team and project policy
management and more sign up at https://pyup.io or email sales@pyup.io

+========================================================================+

safety reports pip 22 contains vulnerabilities.

https://data.safetycli.com/v/62044/f17/

Jammy appears to be targeting pip v22:

# pip --version
pip 22.0.2 from /usr/lib/python3/dist-packages/pip (python 3.10)

Have Debian/Ubuntu truly backported security patches into pip 22? Which
security databases document this? The MITRE page for the vulnerability does
not mention any Debian or Ubuntu specific security patch backporting.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5752

In addition to the pip CVE, safety reports two other Python package CVE's,
in setuptools and wheel:

https://data.safetycli.com/v/52495/f17

https://data.safetycli.com/v/51499/f17

Again, neither the safety nor the MITRE reports indicate any OS
distribution backporting for Debian or Ubuntu. However, the MITRE page for
the setuptools CVE mentions Fedora advisory identifiers.

I'm not sure if the safety database integrates with information about OS
distribution security backports. Perhaps now would be a good time to rope
in the folks at safetycli.com for clarification. If there is a
machine-queriable database of backports, then that would be good for safety
to consume. It would have some additional work to do in terms of
distinguishing between OS distribution packages, versus project specific
packages (e.g. ASDF, virtualenv, etc). Since out of OS distribution Python
packages would not contain those backports.

As a workaround, I can use Fedora in my Docker projects as the base image,
which currently reports a clean safety scan by default.

On Sat, Jan 6, 2024 at 11:05 AM Marc Deslauriers <2048424@bugs.launchpad.net>
wrote:

> Thanks for reporting this issue.
>
> The safety tool is relying on versions of python modules to determine if
> something is vulnerable or not. Ubuntu, like most linux distros,
> backports security updates to existing versions.
>
> Please look up each CVE reported by the safety tool using our web
> interface here and report back any that are not a false positive:
> https://ubuntu.com/security/cves
>
> Thanks!
>
> ** Changed in: python (Ubuntu)
>        Status: New => Incomplete
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/2048424
>
> Title:
>   Multiple CVE's reported for stock Python
>
> Status in python package in Ubuntu:
>   Incomplete
>
> Bug description:
>   The SAC safety tool reports many open vulnerabilities for the various
>   Python packages that come preinstalled on Ubuntu.
>
>   https://pypi.org/project/safety/
>
>   To run the tool, execute `safety check`. A few dozen CVE notices will
>   appear.
>
>   Some of the vulnerabilities appear to arise from upstream Debian,
>   which like Ubuntu, tends to be slow about patching these
>   vulnerabilities.
>
>   Notably, stock Fedora appears to have zero Python vulnerabilities
>   found in the safety CVE database.
>
>   Please update or remove the vulnerable packages from the base OS
>   install, so that users can enjoy a more secure system by default.
>   Additionally, the noise from a vulnerable base OS makes it harder for
>   Python developers to determine which CVE's arise from their projects
>   vs what the operating system gives them to work with.
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/ubuntu/+source/python/+bug/2048424/+subscriptions
>
>

-- 
Cheers,
Andrew

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2024-01-06:

#3

CVE-2022-40897 in setuptools for jammy was fixed here:

https://ubuntu.com/security/notices/USN-5817-1

CVE-2022-40898 in wheel for jammy was fixed here:

https://ubuntu.com/security/notices/USN-5821-1

CVE-2023-5752 in pip is currently unfixed as it is a low priority issue that only affects pip when using against a mercurial repository. There is no current ETA.

affects:

python (Ubuntu) → python-pip (Ubuntu)

Seth Arnold (seth-arnold) on 2024-02-10

information type:

Private Security → Public Security

Revision history for this message

Launchpad Janitor (janitor) wrote on 2024-04-10:

#4

[Expired for python-pip (Ubuntu) because there has been no activity for 60 days.]

Changed in python-pip (Ubuntu):
status:	Incomplete → Expired

Ubuntu
python-pip package

Multiple CVE's reported for stock Python

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntupython-pip package

Multiple CVE's reported for stock Python

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
python-pip package