Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

[Security] 26.9.1 dependency-floor review: raise floors for known, reachable advisories (evidence-driven)

Đang mở
  • Có gì không ổn?
#1,950 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
3/5
Thời gian dự kiến
1-2 ngày
Mức phù hợp với người mới
40/100
Loại issue
Tái cấu trúc
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
python
Lĩnh vực
backend, security

Hướng nghiên cứu

Review the evidence base from issue #1949 to confirm each advisory's reachability. Update version floors in pyproject.toml for the listed dependencies, ensuring the changes resolve cleanly with 'just install-dev'. Run CI tests to verify compatibility. Document decisions in CHANGELOG and add comments where non-obvious.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

Review and raise dependency floors in pyproject.toml where there is a known, reachable
security advisory, using the reproducible evidence base from #1949 as the source of truth. This is a
single tracking issue with a tiered checklist (one coordinated PR, or a few small ones).

Governing principles (per the #1949 discussion):

  • Library boundary. autobahn is a library; a floor forces every consumer up, so raise a floor
    only for a declared dependency where the advisory is reachable through autobahn's own use
    (or where the dep is a dev/build tool, which costs consumers nothing).
  • Scan transitively (report), floor selectively. A transitive finding is evidence, not a floor
    driver — do not add direct pins for transitive/unused deps; push those upstream to the owning dep.
  • Evidence-backed, not scanner-authoritative. The scanners in #1949 are DB consumers; the CVE
    IDs below are the starting proposal from a manual audit and MUST be reconciled against the
    autobahn-security-evidence-<tag>.zip artifact before the implementing PR merges. Exploitability /
    applicability stays a human call (recorded in the #1949 annotations/allowlist).

Depends on #1949 (evidence base first). Already landed: cryptography>=50 and the cbor2
runtime split (#1947).

Tier 1 — runtime deps on the reachable attack surface (raise)

autobahn processes untrusted WAMP input with these and/or uses them for TLS/crypto, so advisories are
reachable. (Provisional — confirm each against #1949.)

Dep Current Proposed Advisory (to verify via #1949)
msgpack >=1.0.2 >=1.2.1 CVE-2026-57585 / GHSA-6v7p-g79w-8964 — OOB read / UAF on Unpacker reuse after a caught decode error; directly relevant to WAMP MessagePack decoding
ujson >=4.0.2 >=5.13.0 CVE-2026-54911 / GHSA-3j69-69wj-xqx2 — affects ≤5.12.1, fixed 5.13.0
brotli >=1.0.0 >=1.2.0 Decompression-bomb hardening (urllib3 guidance, CVE-2026-44432 scenario); complements autobahn's own compressed-payload fix (CVE-2026-77528, 26.7.1)
brotlicffi >=1.0.0 >=1.2.0.0 Allocation/resource-exhaustion below 1.2.0.0
pyopenssl ([encryption]) >=20.0.1 >=26.0.0 CVE-2026-27459 (DTLS cookie buffer overflow) + CVE-2026-27448 (TLS callback fail-open), fixed 26.0.0
pynacl ([encryption]) >=1.4.0 >=1.6.2 CVE-2025-69277 — libsodium 1.0.20 update in 1.6.2 (cryptosign signing primitive)

Already done (#1947): cryptography>=50, cbor2>=6.1.0(CPython)/==5.9.0(PyPy).

Tier 2 — dev/build tools (raise; zero downstream cost)

These execute locally in dev/CI, not in consumers' installs. (Provisional — confirm via #1949.)

Dep Current Proposed Advisory
wheel ([build-tools],[dev]) >=0.36.2 >=0.38.1 CVE-2022-40898 — ReDoS in filename validation
pytest ([dev]) >=3.4.2 >=9.0.3 CVE-2025-71176 — insecure tmpdir handling
pyyaml ([dev]) >=4.2b4 >=6.0.2 crosses CVE-2017-18342 / CVE-2019-20477 / CVE-2020-14343 (unsafe load)
setuptools ([dev]) >=70.0.0 >=83.0.0 CVE-2025-47273 (≥78.1.1) + CVE-2026-59890 (<83.0.0)
jinja2 ([benchmark]) >=3.0.0 >=3.1.6 CVE-2025-27516 sandbox escape (+ CVE-2024-56201)

Tier 3 — deliberate call, decision deferred until #1949 evidence exists

Dep Current Candidate Notes
twisted ([twisted],[dev]) >=22.10.0 >=26.4.0? CVE-2026-42304 (twisted.names DNS-compression DoS, fixed 26.4.0rc2/26.4.0). Biggest downstream impact — a hard floor forces all consumers up. Leaning to bump anyway: autobahn is a library but is also used to implement listening servers (WebSocket), and 22.10.0→26.4.0 almost certainly spans multiple CVEs. Decide once #1949 produces a real evidence base showing the exact advisories in that range and their reachability.

Explicitly NOT changing (documented — no advisory / not reachable)

Keep the compatibility floor; do not bump on age alone: txaio, cffi, hyperlink,
importlib-resources, u-msgpack-python, zope.interface, attrs, service-identity
(its own cryptography>=47 need is already covered by our >=50), pytrie, qrcode, base58,
argon2-cffi, passlib (1.7.4 is latest upstream; maintenance concern, not a CVE), docs extras, etc.

  • ecdsa / Minerva (CVE-2024-23342): N/A. autobahn's only ecdsa use is secp256k1 BIP32
    derivation math (mnemonic.py), never P-256 signing; signing is Ed25519 (nacl). No floor needed
    on Minerva grounds. (CVE-2026-33936 DER-parse DoS is also not reachable — derivation consumes raw
    32-byte scalars, not DER keys.) Record as an allowlist entry in #1949.
  • Vendored FlatBuffers is out of scope here — handled in a separate, coordinated
    autobahn + zlmdb pair of issues (a Python package scan cannot bump vendored C++, and the version
    is locked to zlmdb via check_zlmdb_flatbuffers_version_in_sync()).
  • Transitive-only findings (e.g. numpy via bjdata) are recorded informationally, not turned
    into direct floors.

Acceptance criteria

  • Each proposed floor reconciled against the #1949 evidence base (advisory confirmed, version confirmed).
  • Tier 1 + Tier 2 floors raised in pyproject.toml; CHANGELOG 26.9.1 "Security"/"Dependencies" entries added.
  • Twisted decision made and recorded (bump to >=26.4.0, or documented deferral) based on the evidence base.
  • "Not changing" set documented (this issue + a pyproject comment where non-obvious).
  • just install-dev resolves cleanly on CPython + PyPy; CI green.

Notes / links

  • Evidence base: #1949. Already landed: #1947 (cryptography/cbor2).
  • FlatBuffers: separate autobahn + zlmdb issues (coordinated bump).
  • This is a CVE/advisory-driven review of declared deps; it is not an SBOM audit of a consuming
    application's deployed environment (that is a separate boundary — see #1949).
Ngôn ngữ chính
Python
Star
2.5k
Fork
767
Merge trung bình
23 giờ 55 phút
Pull request đã merge (30 ngày)
25

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của crossbario/autobahn-python

Tất cả issue của crossbario/autobahn-python

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.