T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unbounded Third-Party Dependency Creates Supply-Chain Exposure## Vulnerability Details **File Locations**: - `requirements.txt:1` - `setup.py:22-24` - `README.md:25-29` **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1` ```text pdfrw>=0.4 ``` `setup.py:22-24` ```python install_requires=[ "pdfrw>=0.4", ], ``` `README.md:25-29` ```markdown 2. Install pdfrw: ```bash pip install pdfrw ``` ``` ### Technical Analysis The project installs `pdfrw` without an exact version, upper version boundary, package hash, or lock file. The constraint allows the package resolver to install any release from version 0.4 onward, including future releases that were not reviewed by the project maintainers. The documentation also instructs users to install the latest package resolved under the name `pdfrw`, without identifying a trusted package index or providing integrity verification. Consequently, dependency resolution is mutable and builds are not reproducible. This does not demonstrate that the current `pdfrw` release is malicious. The vulnerability is the project's implicit trust in any future matching artifact. A compromised maintainer account, package-index compromise, or malicious future release could introduce attacker-controlled installation or runtime code. ### Attack Path 1. An attacker compromises the upstream package, its publishing account, or the package distribution channel. 2. The attacker publishes a malicious `pdfrw` release whose version satisfies `pdfrw>=0.4`. 3. A user installs this project, runs `pip install -r requirements.txt`, or follows the documented `pip install pdfrw` instruction. 4. The package resolver selects and downloads the malicious release because no exact version or integrity hash is enforced. 5. Attacker-controlled dependency code executes during installation, import, or PDF processing with the privileges of the installing or ...[truncated 672 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the open-ended dependency constraint with an exact, reviewed version: ```text pdfrw==0.4 ``` 2. Generate a hash-locked requirements file using a dependency-management tool such as `pip-tools`, Poetry, or an equivalent mechanism: ```text pdfrw==0.4 \ --hash=sha256:<verified-package-hash> ``` 3. Install production dependencies with hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 4. Retain the exact runtime version in the lock file even if `setup.py` uses a compatibility range for library consumers. 5. Configure builds to use an explicitly trusted package index and prevent fallback to untrusted indexes. 6. Review release provenance, package signatures where available, maintainer changes, and dependency diffs before updating the pinned version. 7. Run dependency installation and PDF processing inside a least-privileged virtual environment or isolated container. 8. Add automated dependency scanning and a controlled update process so security fixes can be adopted without silently accepting arbitrary future releases.