{"id":100875,"date":"2021-07-30T16:22:41","date_gmt":"2021-07-30T14:22:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod"},"modified":"2021-07-30T16:22:41","modified_gmt":"2021-07-30T14:22:41","slug":"46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod","title":{"rendered":"46% of Python packages in the PyPI repository contain potentially unsafe code","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A group of researchers from the University of Turku (Finland) published the results of an analysis of packages in the PyPI repository for the use of potentially hazardous constructs that could lead to vulnerabilities. During the analysis of 197 thousand packages, 749 thousand potential security issues were identified. In 46% of the packages, at least one such issue was present. Among the most frequently encountered problems are shortcomings related to exception handling and the use of capabilities that allow code injection. <\/p>\n
Out of the identified 749 thousand issues, 442 thousand (41%) are marked as minor, 227 thousand (30%) as moderate risk problems, and 80 thousand (11%) as dangerous. Some packages stand out from the rest and contain thousands of issues: for example, the PyGGI package has 2589 issues mainly related to the use of the 'try-except-pass' construct, and the appengine-sdk package has 2356 issues. A significant number of problems are also present in the genie.libs.ops, pbcore, and genie.libs.parser packages. <\/p>\n
It should be noted that the results were obtained based on automated static analysis, which does not take into account the context of the use of certain constructs. The developer of the bandit tool, which was used for code scanning, expressed the opinion that due to the relatively high number of false positives, the results of the check cannot be directly considered vulnerabilities without further manual review of each issue. <\/p>\n
For example, the analyzer considers the use of unreliable random number generators and hashing algorithms such as MD5 to be a security problem, while in the code such algorithms may be used for purposes that do not impact security. The analyzer also considers any handling of external data in unsafe functions, such as pickle, yaml.load, subprocess, and eval, to be a problem, but this usage is not necessarily associated with the emergence of vulnerabilities, and in practice, the use of these functions can be implemented without security threats. <\/p>\n
Among the checks used in the study: <\/p>\n
\n
The use of potentially unsafe functions like exec, mktemp, eval, mark_safe, etc.\n
Insecure file access permissions.\n
Binding a network socket to all network interfaces.\n
Using hardcoded passwords and keys.\n
Using a predefined temporary directory.\n
Using pass and continue in catch-all-style exception handlers.\n
Running web applications based on the Flask web framework with debug mode enabled.\n
Using unsafe data deserialization methods.\n
Using MD2, MD4, MD5, and SHA1 hash functions.\n
Using unsafe ciphers including DES and encryption modes.\n
Using an unsafe implementation of HTTPSConnection in some versions of Python.\n
Specifying the file:\/\/ scheme in urlopen.\n
Using pseudo-random number generators for cryptographic tasks.\n
Using the Telnet protocol.\n
Using unsafe XML parsers. <\/ul>\n
Additionally, it is worth noting the discovery of 8 malicious packages in the PyPI directory. Prior to their removal, these problematic packages had been downloaded over 30,000 times. To conceal malicious activity and bypass warnings from simple static analyzers, the packages employed base64 encoding of code blocks and organized execution after decoding via eval calls. <\/p>\n
In the packages noblesse, genesisbot, are, suffer, noblesse2, and noblessev2, code was found to intercept credit card numbers and passwords saved in Chrome and Edge browsers, as well as to transmit account tokens from the Discord application and send system data, including screenshots of the screen content. The packages pytagora and pytagora2 had the capability to download and execute third-party executable code. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"