Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SNYK Scan Finding: pyopenssl - Resource Exhaustion #4591

Closed
1 task
FuhuXia opened this issue Jan 19, 2024 · 7 comments
Closed
1 task

SNYK Scan Finding: pyopenssl - Resource Exhaustion #4591

FuhuXia opened this issue Jan 19, 2024 · 7 comments
Assignees
@rshewitt
Labels
bug Software defect or bug compliance Relating to security compliance or documentation component/static Issues related to the Static/Jekyll component playbooks/roles
Milestone
2025-02-01 February

Comments

@FuhuXia
Copy link
Member

FuhuXia commented Jan 19, 2024

Please keep any sensitive details in Google Drive.

Date of report: 2024-01-16
Severity: Moderate
Due date: 2024-04-26

Due date is based on severity and described in RA-5. 15-days for Critical, 30-days for High, and 90-days for Moderate and lower.

  • Analysis has been performed and an issue has been linked to address other occurrences for this class of vulnerability* (link)

* When a finding is identified, we create two issues. One to address the specific instance identified in the report. The other is to identify and address all other occurrences of this vulnerability within the application.

Brief description

https://security.snyk.io/vuln/SNYK-PYTHON-PYOPENSSL-6157250
@FuhuXia FuhuXia added compliance Relating to security compliance or documentation bug Software defect or bug labels Jan 19, 2024
@btylerburton btylerburton added this to the April 2024 milestone Jan 24, 2024
@gujral-rei gujral-rei moved this to 🧊 Icebox in data.gov team board Jan 25, 2024
@gujral-rei gujral-rei moved this from 🧊 Icebox to 📟 Sprint Backlog [7] in data.gov team board May 30, 2024
@rshewitt rshewitt mentioned this issue May 30, 2024
Merged
4 tasks
@rshewitt rshewitt modified the milestones: April 2024, August 2024 May 30, 2024
@rshewitt rshewitt mentioned this issue May 30, 2024
Merged
@rshewitt
Copy link
Contributor

there's currently no fix for this issue yet although some work had been done previously. both are accounted for in catalog and inventory via snyk files. exp dates have been updated.

@rshewitt rshewitt self-assigned this May 30, 2024
@hkdctol hkdctol moved this from 📟 Sprint Backlog [7] to 📔 Product Backlog in data.gov team board Jun 6, 2024
jbrown-xentity added a commit to GSA/inventory-app that referenced this issue Aug 1, 2024
@jbrown-xentity
Update .snyk
46333cf 
Update per GSA/data.gov#4591, still no fix.
@btylerburton
Copy link
Contributor

still no fix

@btylerburton btylerburton added the component/static Issues related to the Static/Jekyll component playbooks/roles label Oct 10, 2024
@btylerburton btylerburton moved this from 📔 Product Backlog to 📥 Queue in data.gov team board Oct 10, 2024
@jbrown-xentity
Copy link
Contributor

Still no fix.

@Bagesary
Copy link

No fix until now

@btylerburton
Copy link
Contributor

Moving to Feb '25 mileston due to no fix

@rshewitt rshewitt removed their assignment Feb 13, 2025
@Bagesary Bagesary moved this from 📥 Queue to 📟 Sprint Backlog [7] in data.gov team board Feb 20, 2025
@btylerburton
Copy link
Contributor

Remediation available:
Upgrade pyopenssl to version 24.0.0 or higher.

@rshewitt rshewitt self-assigned this Feb 27, 2025
@rshewitt rshewitt moved this from 📟 Sprint Backlog [7] to 🏗 In Progress [8] in data.gov team board Feb 27, 2025
@rshewitt rshewitt mentioned this issue Feb 27, 2025
Merged
@rshewitt rshewitt mentioned this issue Feb 27, 2025
Merged
4 tasks
@rshewitt rshewitt moved this from 🏗 In Progress [8] to 👀 Needs Review [2] in data.gov team board Feb 27, 2025
@jbrown-xentity
Copy link
Contributor

The fix is to use pyopenSSL version greater than 24.0.0.
Done in catalog: https://github.com/GSA/catalog.data.gov/blob/main/ckan/requirements.txt#L76
Done in inventory: https://github.com/GSA/inventory-app/blob/main/requirements.txt#L67

@jbrown-xentity jbrown-xentity moved this from 👀 Needs Review [2] to ✔ Done in data.gov team board Feb 28, 2025
@jbrown-xentity jbrown-xentity closed this as completed by moving to ✔ Done in data.gov team board Feb 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rshewitt rshewitt

Labels
bug Software defect or bug compliance Relating to security compliance or documentation component/static Issues related to the Static/Jekyll component playbooks/roles
Projects
data.gov team board
Status: ✔ Done
Milestone
2025-02-01 February
Development

No branches or pull requests
5 participants
@FuhuXia @jbrown-xentity @rshewitt @btylerburton @Bagesary