I reviewed python-configshell-fb 1.1.fb25-1.1 as checked into focal. This
shouldn't be considered a full audit but rather a quick gauge of
maintainability.
python-configshell-fb provides a python library which is used for building
CLI based user-interfaces. Upstream appears healthy and responsive.
- CVE History:
- None
- No security relevant Build-Depends
- debhelper, dh-python, python3-all, python3-pyparsing, python3-setuptools,
python3-six
- pre/post inst/rm scripts
- These are fine - just the auto-generated ones by dh_python3 to
py3compile on postinst and py3clean on prerm
- No init scripts
- No systemd units
- No dbus services
- No setuid binaries
- No binaries in PATH
- No sudo fragments
- No polkit files
- No udev rules
- No unit tests / autopkgtests
- This will make doing any security updates hard to test...
- No cron jobs
- Clean build log
- No processes spawned
- File IO
- Uses files for preferences and logging but these are all parameters to
the library and not hard-coded
- Preferences are saved and restored using pickle which could present a
security issue since this does little sanity checking on formats etc -
however this is done using a file-name provided by the user of the
library and relative to the user's home directory so this is likely
safe - although there is no use of umask() to ensure this file is not
accessible by others so perhaps that at least should be employed
- Logging
- Uses general python format strings etc - this is safe
- No environment variable usage
- No Use of privileged functions
- No Use of cryptography / random number sources etc
- No Use of temp files
- No Use of networking
- No Use of WebKit
- No Use of PolicyKit
Static analysis via bandit and Coverity does not show anything
significant
Security team ACK for promoting python-configshell-fb to main however I
would be happier if some unit tests were added so that some testing can be
done for any future updates to ensure regressions are not introduced.
** Changed in: python-configshell-fb (Ubuntu)
Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1854362
Title:
[MIR] ceph-iscsi, tcmu, python-configshell-fb, python-rtslib-fb,
urwid, targetcli-fb
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ceph-iscsi/+bug/1854362/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
