Security Fix for Insecure Deserialization - huntr.dev#4541
Security Fix for Insecure Deserialization - huntr.dev#4541huntr-helper wants to merge 2 commits intonetworkx:masterfrom
Conversation
Arbitrary code execution fix
|
Test failures seem related. |
|
This is also a deprecated function that we are planning to remove. My vote would be to just close this. |
|
See also #4548 |
|
Any chance that you pull the fix into an earlier version? Our security scanning systems are flagging this up. |
|
Just to make sure I understand your needs... Would a new release of NetworkX (coming soon) correct your issues? |
|
Hi, we have a middle-man artifact tool (JFrog) which has a security scanner (Xray) which has blocked networkx due to this vulnerability. We have managed to get an exception added but it would be good to know timescales for a release to resolve to be able to remove the expcetion. My understanding from scanning all the related issues/PR is v2.6 should remove the vulnerability as PyYAML has been updated to remove the unsafe code (the offending function has different loader type, similar to this PR, from #4548). In a future v3 the whole thing is going to go as it is deprecated. Is there a timescale on v2.6 release? |
|
v2.6 should be out by May 31st. |
https://huntr.dev/users/B3EF has fixed the Insecure Deserialization vulnerability 🔨. Think you could fix a vulnerability like this?
Get involved at https://huntr.dev/
Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/pip/networkx/1/README.md
User Comments:
📊 Metadata *
Arbitrary code execution fix
Bounty URL: https://www.huntr.dev/bounties/1-pip-networkx
⚙️ Description *
NetworkX is a Python package for the creation, manipulation, and study of the structure, dynamics, and functions of complex networks. This package was vulnerable to Arbitrary code execution via Insecure YAML deserialization due to the use of a known vulnerable function load() in yaml.
💻 Technical Description *
This package was vulnerable to Arbitrary code execution due to the use of a known vulnerable function load() in YAML. Changing that to safe_load or using SafeLoader will fix the issue.
🐛 Proof of Concept (PoC) *
🔥 Proof of Fix (PoF) *
👍 User Acceptance Testing (UAT)
I have just changed the load function to safe_load it ain't going to break anything