Description
Hi, @jdavid , @carlosmn , I'd like to report a vulnerability issue in pygit2_1.9.1.
Dependency Graph between Python and Shared Libraries
Issue Description
As shown in the above dependency graph(here shows part of the dependency graph, which depends on vulnerable shared libraries), pygit2_1.9.1 directly or transitively depends on 15 C libraries (.so). However, I noticed that some C libraries are vulnerable, containing the following CVEs:
libcrypto-17bcacf6.so.1.0.2k
and libssl-53a623ad.so.1.0.2k
from C project openssl(version:1.0.2k) exposed 11 vulnerabilities:
CVE-2018-0732, CVE-2019-1559, CVE-2019-1547, CVE-2019-1563, CVE-2019-1551, CVE-2020-1971, CVE-2021-23841, CVE-2020-1968, CVE-2018-0734, CVE-2017-3736, CVE-2019-1552
libgssapi_krb5-497db0c6.so.2.2
, libk5crypto-b1f99d5c.so.3.1
and libkrb5-fc820a1d.so.3.3
from C project krb5(version:1.16) exposed 2 vulnerabilities:
CVE-2021-37750,CVE-2021-36222
Suggested Vulnerability Patch Versions
openssl has fixed the vulnerabilities in versions >=1.1.1l
krb5 has fixed the vulnerabilities in versions >=1.19.3
Python build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Python projects.
As a popular python package (pygit2 has 630,559 downloads per month), could you please upgrade the above shared libraries to their patch versions?
Thanks for your help~
Best regards,
MikeWazowski