Adding auditing to pip [LWN.net]

Adding auditing to pip

Posted Aug 16, 2022 12:37 UTC (Tue) by kleptog (subscriber, #1183)
In reply to: Adding auditing to pip by amarao
Parent article: Adding auditing to pip

There's always a way to ignore particular warnings from a tool. We have safety as part of our build pipeline and when it fails we need to check. Mostly it's just a minor upgrade, but we've had cases where it requires a major package upgrade which we don't have time for, and the actual issue doesn't affect us anyway because it's in some plugin we don't use, or the way our data is structured that corner case doesn't appear. It gets added to the ignore file with a comment and that's that.

If your security team can't accept that, then that's their problem. Not every CVE is equally important or equally relevant.

to post comments

Adding auditing to pip

Posted Aug 16, 2022 13:52 UTC (Tue) by amarao (guest, #87073) [Link] (1 responses)

It's not about specific warnings, it's about culture. Basically, you have 'security guy' (with background from, f.e., police or some other non-IT) who was tasked with 'IT-security'. It follows the guidelines and trainings which says 'no vulnerabilities above 6.7 should be in production systems', and there is '7.4' for vulnerability which is not a vulnerability at all. There is no procedure to make it not-a-vulnerability. You explain the reason for ignoring and guy just ignore you (like police officer ignoring explanation for speeding at ticket time). The rules says 'NO VULNERABILITIES ABOVE 6.4 AND YOU HAVE 7.4 ON MY VUN-READER, DOCUMENTS PLEASE'. And there is a way to make this guy quiet. Install package in a way which is not visible for scanner, and you are fine to go (even if you have poodle with heartbleed).

If there is CVE out there, how to make it 'not CVE'? I know no such process.

Adding auditing to pip

Posted Aug 17, 2022 0:31 UTC (Wed) by pabs (subscriber, #43278) [Link]

CVEs can be disputed, you see this all the time if you follow CVE feeds. This is mentioned in the CVE docs on at least these two pages:

https://nvd.nist.gov/general/cve-process
https://nvd.nist.gov/vuln/vulnerability-status