[Snyk] OWSLib Vulnerability

[nickumia-reisys]

Please keep any sensitive details in Google Drive.

Date of report: 03/09/2023
Severity: High
Due date: 04/09/2023

Due date is based on severity and described in RA-5. 15-days for Critical, 30-days for High, and 90-days for Moderate and lower.

• Analysis has been performed and an issue has been linked to address other occurrences for this class of vulnerability* (link)

* When a finding is identified, we create two issues. One to address the specific instance identified in the report. The other is to identify and address all other occurrences of this vulnerability within the application.

Brief description

From our automated snyk scans, the above vulnerability in the owslib package was highlighted. After an investigation of our Github Action Tests, it seems like it is breaking the CSW Harvest Jobs.

• [Snyk + GH Actions] Update requirements catalog.data.gov#861
• https://security.snyk.io/vuln/SNYK-PYTHON-OWSLIB-3356626

[hkdctol]

For one thing--check on the need of the existing CSW harvest sources. Perhaps not use the CSW harvest source at all but get single harvest record.

[hkdctol]

We might fix on our own. Also XML from trusted sources.

[nickumia-reisys]

@btylerburton It seems like the CSW Harvest source is failing on main with the older version of owslib now... so... it might be unrelated now?

• Extend werkzeug + owslib exception expiration catalog.data.gov#918

000_harvest.cy.js.mp4

[btylerburton]

The upgrades to owslib broke the CSW service in deep and unidentifiable ways. After some consideration, since CSW is deprecated as a data source, the team has decided to remove support for the CSW format. Closing this.

[btylerburton]

Leaving open as the vulnerability will still need to be addressed. Moving to blocked until we do that.

[btylerburton]

Fixed in GSA/catalog.data.gov#921

[nickumia-reisys]

For full transparency, I believe this is the starting point for why/when/how we stopped supporting CSW Harvesting.