T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unnecessary Unpinned Standard-Library Backport Dependencies## Vulnerability Details **File Location**: `requirements.txt:1-2` **Vulnerability Type**: Unnecessary and unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```text dataclasses enum ``` The project documentation states that Python 3.7 or later is required and that no external packages are needed: ```bash # Python 3.7+ # No external packages required (uses standard library) ``` ### Technical Analysis Both `dataclasses` and `enum` are part of the Python standard library in the project's stated Python 3.7+ environment. The implementation imports these standard-library modules and does not require separately installed packages with these names. Nevertheless, a conventional installation command such as `pip install -r requirements.txt` instructs `pip` to retrieve unpinned third-party distributions. No exact versions, package hashes, or trusted package index are specified. This creates an unnecessary supply-chain execution path and contradicts the documented dependency model. Python packages may execute build or installation logic during installation. Consequently, compromise of an upstream distribution, unsafe package resolution, or use of an untrusted package index could result in arbitrary code execution under the account running `pip`. ### Attack Path 1. A user or automated deployment pipeline runs: ```bash pip install -r requirements.txt ``` 2. `pip` resolves the unpinned `dataclasses` and `enum` package names through its configured package indexes. 3. Third-party package artifacts are downloaded even though the runtime already provides the required modules. 4. Package build or installation code executes with the privileges of the user or service performing installation. 5. If a resolved distribution or configured index is compromised, malicious installation code could read accessible data, modify the environment, install persistence, or tamper with project files. Exploitation depends on compromise or manipulation ...[truncated 747 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both entries from `requirements.txt`, because Python 3.7+ already supplies `dataclasses` and `enum`. 2. Delete `requirements.txt` or leave it empty if the project has no external runtime dependencies. 3. Keep the documented minimum Python version aligned with the implementation and dependency manifest. 4. If support for an older Python version is intentionally introduced, use explicitly audited backports with exact version pins and cryptographic hashes. 5. Install dependencies only from an approved index and use hash-enforced installation where third-party packages are genuinely necessary, for example: ```bash pip install --require-hashes -r requirements.txt ``` 6. Add an automated dependency-manifest check to prevent standard-library modules or unpinned packages from being added inadvertently.