T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependency Permits Unreviewed Package Updates## Vulnerability Details **File Location**: `requirements.txt:1`; dependency imported at `holiday.py:10-13` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```text chinese-calendar ``` ### Technical Analysis The project declares `chinese-calendar` without an exact version constraint or integrity hash. Package installation therefore resolves whichever compatible release is available from the configured package index at installation time. This makes builds non-reproducible and prevents the audited source from guaranteeing which dependency code users will execute. The application imports this dependency when `holiday.py` starts. Python executes package-level initialization code during import, so a compromised or maliciously replaced release could execute arbitrary code without requiring an additional explicit call into the package. This finding does not establish that the current `chinese-calendar` package is malicious. The risk arises from accepting mutable, unverified third-party releases. ### Attack Path 1. An attacker compromises the dependency's publisher account, release infrastructure, package-index entry, or another part of its distribution chain. 2. The attacker publishes a malicious release under the legitimate package name. 3. A user or deployment pipeline runs `pip install -r requirements.txt`. 4. Because no exact version or hash is specified, the installer may retrieve the attacker-controlled release. 5. The user runs `holiday.py`. 6. Python imports `chinese_calendar`, executing attacker-controlled package initialization code with the privileges and environment access of the current process. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the account that installs or runs the project. The accessible scope may include that account's files, environment variables, credentials available to the process, and network ...[truncated 214 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, for example: ```text chinese-calendar==<reviewed-version> ``` 2. Generate and verify cryptographic hashes for the selected distribution, and install with `pip --require-hashes`. 3. Maintain a lock file or fully pinned requirements file so development, CI, and production resolve identical artifacts. 4. Restrict package installation to a trusted index or an internally controlled package mirror. 5. Run dependency vulnerability and provenance checks in CI before accepting updates. 6. Review dependency updates explicitly rather than automatically accepting the newest published release. 7. Execute the application with least privilege and avoid exposing unnecessary credentials through environment variables.