Skip to content

Dependency with "vulnerable" version of py #2524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
juanitosvq opened this issue Nov 1, 2022 · 3 comments
Closed

Dependency with "vulnerable" version of py #2524

juanitosvq opened this issue Nov 1, 2022 · 3 comments
Labels
bug:normal affects many people or has quite an impact

Comments

@juanitosvq
Copy link

juanitosvq commented Nov 1, 2022 •
edited
Loading

Hi all,

I couldn't find this reported yet (apologies if it's duplicate), but tox has a dependency with py, which is currently flagged as a vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2022-42969 and therefore reported by tools like safety and pip-audit.

There is a lot of chatter in here about whether this should be considered a vulnerability in the first place and whether the vulnerability should be taken down. It doesn't sound like the py maintainers are going to fix the affected code, instead they removed the dependency from pytest altogether by vendoring the code they still needed.

Is this something that could be done in tox as well?

Thanks in advance!
@juanitosvq juanitosvq added the bug:normal affects many people or has quite an impact label Nov 1, 2022
@juanitosvq juanitosvq changed the title Using "vulnerable" version of py Dependency with "vulnerable" version of py Nov 1, 2022
@gaborbernat
Copy link
Member

tox does not uses the part of the lib that has the vulnabirity so I think this is invalid for us.

@juanitosvq juanitosvq mentioned this issue Nov 1, 2022
Closed
@gaborbernat
Copy link
Member

tox 4 does not uses py, 😊 and we have no plans to remove it from tox 3. tox 4 will be released eventually some time next year, hopefully.

@juanitosvq
Copy link
Author

tox does not uses the part of the lib that has the vulnabirity so I think this is invalid for us.

Right, but unfortunately tools like safety and pip-audit will still report the vulnerability in pipelines that contain tox as a dependency. We will have to explicitly ignore that vulnerability or hope that a new version of py is released.

@jiwaszki jiwaszki mentioned this issue Nov 6, 2022
Merged
@jugmac00 jugmac00 mentioned this issue Nov 7, 2022
Closed
TeoZosa added a commit to TeoZosa/cookiecutter-cruft-poetry-tox-pre-commit-ci-cd that referenced this issue Nov 21, 2022
@TeoZosa
🔒 Ignore CVE-2022-42969 until tox 4.0
fbb4727 
Used by tox:
```
❯ poetry show py
 name         : py
 version      : 1.11.0
 description  : library with cross-python path, ini-parsing, io, code, log facilities

required by
 - tox >=1.4.17
```

But tox does not use the affected part of the library
- ref: tox-dev/tox#2524 (comment)
TeoZosa added a commit to TeoZosa/cookiecutter-cruft-poetry-tox-pre-commit-ci-cd that referenced this issue Nov 21, 2022
@TeoZosa
🍪 🔒 Ignore CVE-2022-42969 until tox 4.0
55bbeb7 
Used by tox:
```
❯ poetry show py
 name         : py
 version      : 1.11.0
 description  : library with cross-python path, ini-parsing, io, code, log facilities

required by
 - tox >=1.4.17
```

But tox does not use the affected part of the library
- ref: tox-dev/tox#2524 (comment)
@TeoZosa TeoZosa mentioned this issue Nov 21, 2022
Merged
Cielquan added a commit to rstcheck/rstcheck-core that referenced this issue Nov 29, 2022
@Cielquan
ignore CVE-2022-42969 for safety
eaaf475 
the py lib which has the issue is used by tox 3
but tox does not use the part of the lib which is affected
tox-dev/tox#2524

pytest was updated to 7.2 prior to remove py lib
Cielquan added a commit to rstcheck/rstcheck that referenced this issue Nov 29, 2022
@Cielquan
ignore CVE-2022-42969 for safety
2d69214 
the py lib which has the issue is used by tox 3
but tox does not use the part of the lib which is affected
tox-dev/tox#2524

pytest was updated to 7.2 prior to remove py lib
Cielquan added a commit to Cielquan/verbum that referenced this issue Nov 29, 2022
@Cielquan
ignore CVE-2022-42969 for safety
f1731f3 
the py lib which has the issue is used by tox 3
but tox does not use the part of the lib which is affected
tox-dev/tox#2524

pytest was updated to 7.2 prior to remove py lib
@trexfeathers trexfeathers mentioned this issue Nov 8, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug:normal affects many people or has quite an impact
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@gaborbernat @juanitosvq