T08 · Insecure Dependencies
Note
- Location
- README.md:121
- Finding
- Unpinned Third-Party Cryptographic Dependency## Vulnerability Details **File Location**: `README.md`, lines 116-123 **Vulnerability Type**: Unpinned package installation **Risk Level**: Low ```markdown ### Cryptographic Algorithm Integration A cryptographic library such as `gmssl` or `pysm2` must be integrated to implement actual encryption and decryption: ```bash pip install gmssl ``` ``` ### Technical Analysis The installation instruction retrieves the latest available version of `gmssl` from the package index without specifying an exact version or verifying an artifact hash. Consequently, the installed code is not reproducible and may differ from the version reviewed or tested by the project author. This is particularly sensitive because the dependency is intended to perform cryptographic operations involving business payloads, signatures, certificates, and private keys. If the package, its maintainer account, its release process, or the configured Python package index were compromised, a malicious release could execute during installation or when imported by an implementation based on this example. The package name itself is not demonstrated to be malicious, and the project does not automatically execute this installation command. The risk arises when a user follows the documented command without dependency pinning or integrity verification. ### Attack Path 1. An attacker compromises the upstream package, its publisher credentials, the package index, or a dependency resolved by the package. 2. The attacker publishes a malicious version that still satisfies the unrestricted `pip install gmssl` command. 3. A user follows the README and installs the package. 4. Malicious package installation hooks or imported runtime code execute with the privileges of the user performing the installation. 5. Because the package is intended for cryptographic integration, malicious code could potentially access private keys, plaintext financial payloads, encrypted session key ...[truncated 1148 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, for example: ```bash python -m pip install "gmssl==<reviewed-version>" ``` 2. Maintain dependencies in a lock file or requirements file containing cryptographic hashes, and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Record and verify hashes for all transitive dependencies, not only the direct cryptographic package. 4. Use a controlled internal package mirror or allowlisted registry for production installations. 5. Review the selected library's source, release history, maintenance status, and cryptographic implementation before using it with production keys or financial data. 6. Install dependencies inside a dedicated virtual environment as an unprivileged user rather than globally or with administrator privileges. 7. Add automated dependency vulnerability and provenance scanning to the release process. 8. Keep private-key operations in a hardware security module or dedicated key-management service where possible, preventing the Python dependency from directly reading exportable private-key material.