ISISComputingGroup / ISISComputingGroup/IBEX

LSi Correlator: Update Numpy Dependency to 1.21 or Later

Open
#6,968 1 comment 0 reactions 0 assignees View on GitHub
2
Dominant language
No language data
Stars
6
Forks
2
Avg merge
16h 40m
Merged PRs (30d)
2

Description

## Where?
_Where is the issue likely to be (be as specific as possible e.g. filepaths)_

[LSi Correlator Repository](https://github.com/ISISComputingGroup/EPICS-LSICorrelator) in the following locations:
* `requirements.txt`
* `correlator_driver_functions.py`
* `data_file_interaction.py`
* `mocked_correlator_api.py`
* `tests.py`
* `test_data.py`

## How?
_How did the issue come about/known cause of issue if any? (**delete subheader if not applicable**)_

GitHub Dependabot alert found a vulnerability in repository dependencies. The Vulnerability is inside Numpy versions >= 1.9.0, < 1.21.

The vulnerability is patched in version: 1.21

> A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. - [GitHub Dependabot Alert](https://github.com/ISISComputingGroup/EPICS-LSICorrelator/security/dependabot/requirements.txt/numpy/open)

This vulnerability is not used in the LSi Correlator repository so the vulnerability does not directly affect the repository.

It is however still good practice remove the potential of this vulnerability affecting the repositories security going forward should a need to use the `PyArray_NewFromDescr_int` function of `ctors.c` when specifying arrays of large dimensions (over 32) from Python code.

We should update the dependency to Numpy version 1.21 or later to resolve this problem and update on any machines which use the LSi Correlator.

## Reproducible?
Yes

### To Reproduce
- See dependabot alert: https://github.com/ISISComputingGroup/EPICS-LSICorrelator/security/dependabot/requirements.txt/numpy/open

## Acceptance criteria
- [ ] Numpy version 1.21 or later is used by the LSi Correlator.
- [ ] `requirements.txt` specifies a version of numpy that is 1.21 or later.
- [ ] All unit tests and IOC system tests pass after upgrading the version used.
- [ ] Any machines using the LSi Correlator have been updated to use Numpy 1.21 or later.
- [ ] Pylint GitHub workflow passes.

## How to Test
_verbose instructions for reviewer to test changes
* Run master\tests.py using the command python tests.py from an epics environment.
* Test the IOC from an epics environment from `C:\Instrument\Apps\EPICS\support\EPICS-IOC_Test_Framework\` by running `python run_tests.py -t lsicorr`.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.