Document 16 CVEs in bundled cryptography 40.0.2 and pin secure versions - #4
Open
kurtadsheh99 wants to merge 1 commit into
Open
Document 16 CVEs in bundled cryptography 40.0.2 and pin secure versions#4kurtadsheh99 wants to merge 1 commit into
kurtadsheh99 wants to merge 1 commit into
Conversation
The shipped File_Encrypt.exe and sources.zip were built with cryptography==40.0.2 and cffi==1.15.1 (extracted from the PYZ archive in sources.zip). pip-audit reports 16 known vulnerabilities in that cryptography version, including CVE-2023-50782, CVE-2024-0727, GHSA-jm77-qphf-c4w8, GHSA-v8gr-m533-ghj9, and GHSA-h4gh-qq45-vh27. The repository does not include the Python source, so the binary cannot be rebuilt automatically. Adding SECURITY.md and a pinned requirements.txt to record the findings and the target versions for a clean rebuild. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A dependency/package scan across the three in-scope repos turned up one vulnerable dependency: the
File_Encrypt.exeandsources.zipartifacts in this repository were built againstcryptography==40.0.2, which carries 16 known vulnerabilities in the Python advisory database.Versions were recovered by unzipping
sources.zip, parsing the PyInstallerPYZ-00.pyzarchive, and decompilingcryptography.__about__andcffi.__init__from the embedded bytecode:cryptography==40.0.2— 16 advisoriescffi==1.15.1— outdated, no current critical CVEs3.11.3runtimeSample advisories against
cryptography==40.0.2load_pem_pkcs7_certificates(Full list reproducible via
pip-audit -r requirements.txtagainst the legacy pins.)Changes
SECURITY.mdwith the advisory table and rebuild instructions.requirements.txtpinning known-good versions (cryptography>=44.0.1,pycryptodome>=3.20.0,cffi>=1.17.1,pyinstaller>=6.11.1) for the next rebuild.What this PR does not do
The repository ships only the compiled
File_Encrypt.exeplus a PyInstallersources.zip— the Python source (File_Encrypt.py) is not checked in, so the executable cannot be rebuilt from this branch alone. The fix here is documentation + target pins; replacing the binary requires you to add the source and rerunpyinstaller --onefile File_Encrypt.pyagainst the pinned requirements.Other repositories in scope
package.json; CDN libs (aos@2.3.4,@emailjs/browser@4.4.1,font-awesome@6.7.2) all at latest,npm auditreports 0 vulnerabilities.System.Windows.Forms/System.Drawing— no third-party dependencies.Test plan
SECURITY.mdfor accuracy.requirements.txtwork with your existingFile_Encrypt.pysource.File_Encrypt.exeagainst the new pins and replace the artifact.File_Encrypt.pyto the repository so future audits don't need to reverse-engineer the PYZ.Generated by Claude Code