coin-or / coin-or/python-mip

Potential secutiry vulnerabilities in the C libraries which mip depends on. Can you help upgrade to patch versions?

Open
#263 5 comments 0 reactions 0 assignees View on GitHub
cbc-platform
Dominant language
Linear Programming
Stars
600
Forks
108
PR merge metrics
No merged PRs in 30d

Description

Hi, @h-g-s , @tuliotoffolo , I'd like to report a vulnerability issue in **mip_1.13.0**.
### Dependency Graph between Python and Shared Libraries
![image](https://user-images.githubusercontent.com/102780639/161431117-b1fe71b8-cdc3-4ade-867e-8bbb4eb3cc2e.png)
### Issue Description
As shown in the above dependency graph(here shows part of the dependency graph, which depends on vulnerable shared libraries), **mip_1.13.0** directly or transitively depends on ***42*** C libraries (.so). However, I noticed that one C library is vulnerable, containing the following CVEs:
`libtinfo.so.5`from C project **ncurses(version:5.9)** exposed ***3*** vulnerabilities:
[CVE-2019-17595](https://nvd.nist.gov/vuln/detail/CVE-2019-17595), [CVE-2019-17594](https://nvd.nist.gov/vuln/detail/CVE-2019-17594), [CVE-2021-39537](https://nvd.nist.gov/vuln/detail/CVE-2021-39537)
### Suggested Vulnerability Patch Versions
***ncurses*** has fixed the vulnerabilities in versions ***>=6.3***

Python build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Python projects.
As a popular python package (**mip** has **69,109** downloads per month), could you please upgrade the above shared libraries to their patch versions?

Thanks for your help~
Best regards,
MikeWazowski

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.