Security Disclosure: lxml CVE

[bryanculver]

This issue was created in response to a report to our security mailer.

Internal reference for this disclosure is NAUTOBOT-735.

In the belief of strong transparency, we record this here to publicly acknowledge our receipt of this disclosure, our investigation, our summary, and ultimate outcome.

The Report

Hello

I installed the poetry audit plugin and it shows me the following vulnerability (nautobot / develop)

poetry-audit-plugin 0.3.0 Poetry plugin for checking security vulnerabilities in dependencies

Maybe this scan could be part of the CI pipeline?

poetry audit
# poetry audit report
Loading...
Scanning 206 packages...
 
  • lxml  installed 4.6.5  affected <4.9.1  CVE CVE-2022-2309

The Analysis

On investigation this is due to social-auth-core (a direct Nautobot dependency) still not shipping a release that relaxes a rigid restraint on lxml < 4.7. We investigated this when it was reported and unfortunately, Poetry will reject our override of this with dependency mismatch (we have no direct dependency on lxml).

social-auth-core’s dependency tree: https://libraries.io/pypi/social-auth-core/4.3.0/tree
Related issue: python-social-auth/social-core#659

It seems that was recently addressed (this Jan) but has yet to see a release: python-social-auth/social-core#738

Our Summary

Nautobot does not use lxml directly and does not handle the concerning payloads directly. Limited to social-auth-core's use should be minimal concern and ultimately had a breaking impact to use with SAML providers if updated (details in related issue above).

Once a release of social-auth-core is available that no longer requires the lxml < 4.7 we will promptly update and publish a release in accordance to our normal dependency update policy.

Going Forward

We will continue use Dependabot which monitors all of our dependencies for CVEs, even if we can’t address them. Thank you for the suggestion for poetry-audit-plugin but we cannot address this CVE until it is addressed upstream.

[bryanculver]

Update: this was addressed in #3706.