Potential secutiry vulnerabilities in the C libraries which mip depends on. Can you help upgrade to patch versions?
- Dominant language
- Linear Programming
- Stars
- 600
- Forks
- 108
- PR merge metrics
- No merged PRs in 30d
Description
Hi, @h-g-s , @tuliotoffolo , I'd like to report a vulnerability issue in **mip_1.13.0**.
### Dependency Graph between Python and Shared Libraries

### Issue Description
As shown in the above dependency graph(here shows part of the dependency graph, which depends on vulnerable shared libraries), **mip_1.13.0** directly or transitively depends on ***42*** C libraries (.so). However, I noticed that one C library is vulnerable, containing the following CVEs:
`libtinfo.so.5`from C project **ncurses(version:5.9)** exposed ***3*** vulnerabilities:
[CVE-2019-17595](https://nvd.nist.gov/vuln/detail/CVE-2019-17595), [CVE-2019-17594](https://nvd.nist.gov/vuln/detail/CVE-2019-17594), [CVE-2021-39537](https://nvd.nist.gov/vuln/detail/CVE-2021-39537)
### Suggested Vulnerability Patch Versions
***ncurses*** has fixed the vulnerabilities in versions ***>=6.3***
Python build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Python projects.
As a popular python package (**mip** has **69,109** downloads per month), could you please upgrade the above shared libraries to their patch versions?
Thanks for your help~
Best regards,
MikeWazowski
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.