Pin safe dependency versions; document CVEs in shipped File_Encrypt.exe - #5
Open
kurtadsheh99 wants to merge 1 commit into
Open
Pin safe dependency versions; document CVEs in shipped File_Encrypt.exe#5kurtadsheh99 wants to merge 1 commit into
kurtadsheh99 wants to merge 1 commit into
Conversation
The File_Encrypt.exe currently in main was built with PyInstaller in April 2023 and bundles cryptography 40.0.2 and setuptools 65.5.0, both of which have known CVEs fixed in later releases. Add requirements.txt with floor versions that patch every known advisory affecting the currently bundled libraries, and a SECURITY.md that documents the issue and gives reproducible rebuild instructions. This does not rewrite the shipped executable (rebuild requires the Windows source .py, which is not in this repo); it makes the next rebuild pick non-vulnerable versions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ran a dependency vulnerability scan across the three in-scope repositories (portfolio-website, filesystembackup, file_encryptor). The first two have no third-party dependencies with known CVEs. This PR addresses the findings for file_encryptor.
File_Encrypt.exeonmainwas built with PyInstaller in April 2023 (Python 3.11.3). Inspectingsources.zip(the PyInstaller build directory) exposes the bundleddist-infoentries, which show:cryptography40.0.2 — vulnerablesetuptools65.5.0 — vulnerablepycryptodome(imported asCrypto) — version not recorded in the manifest; recommend upgradingNotable CVEs affecting the versions above:
PackageIndex.download)Changes
requirements.txtpinning floor versions that patch every known advisory affecting the currently bundled libraries.SECURITY.mddocumenting the bundled-library CVEs, giving safe rebuild instructions, and directing vulnerability reports to the private advisory workflow.Scope note
The repository does not check in the source
File_Encrypt.py; only the compiled.exeand the PyInstaller build directory (sources.zip) are tracked. Rewriting the shipped executable therefore requires a Windows rebuild against these pinned versions using the original source, which is out of scope for this automated scan. This PR does not modifyFile_Encrypt.exe; it ensures the next rebuild picks non-vulnerable dependencies.Test plan
requirements.txtpins against the project's Python version and rebuild toolchain preferencesFile_Encrypt.exeon Windows using the PowerShell steps inSECURITY.mdand confirm the app still functionscryptography-40.0.2.dist-info/setuptools-65.5.0.dist-infoGenerated by Claude Code