ISISComputingGroup / ISISComputingGroup/IBEX
LSi Correlator: Update Numpy Dependency to 1.21 or Later
- Dominant language
- No language data
- Stars
- 6
- Forks
- 2
- Avg merge
- 16h 40m
- Merged PRs (30d)
- 2
Description
## Where?
_Where is the issue likely to be (be as specific as possible e.g. filepaths)_
[LSi Correlator Repository](https://github.com/ISISComputingGroup/EPICS-LSICorrelator) in the following locations:
* `requirements.txt`
* `correlator_driver_functions.py`
* `data_file_interaction.py`
* `mocked_correlator_api.py`
* `tests.py`
* `test_data.py`
## How?
_How did the issue come about/known cause of issue if any? (**delete subheader if not applicable**)_
GitHub Dependabot alert found a vulnerability in repository dependencies. The Vulnerability is inside Numpy versions >= 1.9.0, < 1.21.
The vulnerability is patched in version: 1.21
> A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. - [GitHub Dependabot Alert](https://github.com/ISISComputingGroup/EPICS-LSICorrelator/security/dependabot/requirements.txt/numpy/open)
This vulnerability is not used in the LSi Correlator repository so the vulnerability does not directly affect the repository.
It is however still good practice remove the potential of this vulnerability affecting the repositories security going forward should a need to use the `PyArray_NewFromDescr_int` function of `ctors.c` when specifying arrays of large dimensions (over 32) from Python code.
We should update the dependency to Numpy version 1.21 or later to resolve this problem and update on any machines which use the LSi Correlator.
## Reproducible?
Yes
### To Reproduce
- See dependabot alert: https://github.com/ISISComputingGroup/EPICS-LSICorrelator/security/dependabot/requirements.txt/numpy/open
## Acceptance criteria
- [ ] Numpy version 1.21 or later is used by the LSi Correlator.
- [ ] `requirements.txt` specifies a version of numpy that is 1.21 or later.
- [ ] All unit tests and IOC system tests pass after upgrading the version used.
- [ ] Any machines using the LSi Correlator have been updated to use Numpy 1.21 or later.
- [ ] Pylint GitHub workflow passes.
## How to Test
_verbose instructions for reviewer to test changes
* Run master\tests.py using the command python tests.py from an epics environment.
* Test the IOC from an epics environment from `C:\Instrument\Apps\EPICS\support\EPICS-IOC_Test_Framework\` by running `python run_tests.py -t lsicorr`.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.