pySCG: Replacing CWE-400 with something that describes the resource exhaustion case better

Aberta
  • Algo errado?
#17 1 comentário 0 reações 1 responsável Ver no GitHub

@myteron já está trabalhando nisso.

Desde 22/10/2024.

Avaliação

Esta issue ainda não foi avaliada.

Descrição

The description of CWE-400 in MITRE document (https://cwe.mitre.org/data/definitions/400.html#Vulnerability_Mapping_Notes_400) suggests this:

Usage: DISCOURAGED(this CWE ID should not be used to map to real-world vulnerabilities)

Reason: Frequent Misuse

Rationale:

[CWE-400](https://cwe.mitre.org/data/definitions/400.html) is intended for incorrect behaviors in which the product is expected to track and restrict how many resources it consumes, but [CWE-400](https://cwe.mitre.org/data/definitions/400.html) is often misused because it is conflated with the "technical impact" of vulnerabilities in which resource consumption occurs. It is sometimes used for low-information vulnerability reports. It is a level-1 Class (i.e., a child of a Pillar).

Comments:

Closely analyze the specific mistake that is causing resource consumption, and perform a CWE mapping for that mistake. Consider children/descendants such as [CWE-770](https://cwe.mitre.org/data/definitions/770.html): Allocation of Resources Without Limits or Throttling, [CWE-771](https://cwe.mitre.org/data/definitions/771.html): Missing Reference to Active Allocated Resource, [CWE-410](https://cwe.mitre.org/data/definitions/410.html): Insufficient Resource Pool, [CWE-772](https://cwe.mitre.org/data/definitions/772.html): Missing Release of Resource after Effective Lifetime, [CWE-834](https://cwe.mitre.org/data/definitions/834.html): Excessive Iteration, [CWE-405](https://cwe.mitre.org/data/definitions/405.html): Asymmetric Resource Consumption (Amplification), and others.

Do you want to pinpoint to another specific CWE that is more appropriate?

Linguagem predominante
Python
Estrelas
2
Forks
2
Merge médio
11min
PRs com merge (30d)
2

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de ossf/python-secure-coding-guide

Todas as issues de ossf/python-secure-coding-guide

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.